Skip to content

FedRAMP Low Baseline Rev 4

The Federal Risk and Authorization Management Program (FedRAMP) Low Impact Baseline Revision 4 establishes security requirements for cloud services handling low-impact federal information. Managed by the U.S. General Services Administration (GSA), this baseline is derived from NIST SP 800-53 and requires implementation of 125 security controls. It applies to cloud service providers offering services to U.S. federal agencies for systems with low confidentiality, integrity, and availability requirements.

Terraform Registry Subdomain: fedramplow

module "..." {
  source  = "fedramplow.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

module "..." {
  source = "https://fedramplow.compliance.tf/terraform-aws-modules/<module>/aws"
}

Refer to the Terraform Registry Endpoints section for more details.

Implemented Controls

The following controls are implemented as part of this framework.

Enable/Disable Controls

You can customize the Terraform module for the desired compliance requirements by enabling/disabling individual controls.

Examples

S3 bucket module with FedRAMP Low Baseline Rev 4 compliance framework controls enabled, and a couple of controls disabled

module "..." {
  source = "https://fedramplow.compliance.tf/terraform-aws-modules/s3-bucket/aws?disable=apigateway_stage_logging_enabled,backup_plan_min_retention_35_days"
}