What is a config snapshot?
A config snapshot is a frozen, published copy of a resolved compliance configuration: the resolved frameworks, controls and rules that an environment serves. Because environments reference snapshots rather than editable drafts, the same reviewed controls and rules stay in effect until a different snapshot is promoted.
Why it matters
Direct reads from an editable configuration would push every change into production immediately, and afterward no one could state which version was active on a particular date. A snapshot draws a line between authoring and delivery: drafts may be revised at will, published snapshots stay fixed, and an environment changes only when it is pointed at a different snapshot.
How compliance.tf applies it
Within compliance.tf, a config is a named workspace that contains a single editable draft made of four parts: frameworks, controls, forbidden and rules. Publishing resolves that draft and freezes the outcome as a snapshot:
- Each framework is expanded to a concrete list of control IDs.
- Entries in
forbiddenremove controls from that list. - Entries in
controlsadd controls to it. - Rules are checked, and their parameters are completed.
Once published:
- The snapshot's contents and provenance cannot change; only the approval state can move, and only one time.
- Publishing and approval are distinct actions, and neither one puts anything into service. That is the job of a promotion gate.
- There is no way to unpublish or delete.
- The module manifest includes
posture.snapshot_id, which lets you verify the snapshot behind a download.
Things to know
- Saving a draft does not validate it; validation happens at publish time.
- Coverage is recalculated when requested against the catalog current at that moment; it is not stored inside the snapshot.
- Coverage runs per enabled framework. A posture with no framework enabled therefore has no uncovered item and passes every coverage condition, so confirm the enabled frameworks before trusting coverage.