Version Compatibility Matrix
compliance.tf adapters are built against specific major versions of terraform-aws-modules. The table below shows which upstream versions each adapter supports.
How to read this table: If your upstream module version falls within the "Supported Versions" range, you can change the source URL to compliance.tf and keep your existing version constraint. If you are on an older major version, upgrade the upstream module first, then migrate.
Storage
| Module | Supported Versions | Notes |
|---|
| S3 Bucket | >= 5.0.0 | Direct swap from v5.x |
| EFS | >= 2.0.0 | Direct swap from v2.x |
| FSx | ~> 1.3 | Pinned to 1.3.x range. Covers Lustre, OpenZFS, ONTAP, and Windows submodules |
Compute & Containers
| Module | Supported Versions | Notes |
|---|
| Auto Scaling | >= 9.0.0 | Direct swap from v9.x |
| EC2 Instance | >= 6.0.0 | Direct swap from v6.x |
| Lambda | >= 8.0.0 | Direct swap from v8.x |
| ECS | >= 6.0.0 | Direct swap from v6.x |
| EKS | >= 21.0.0 | Direct swap from v21.x |
| ECR | >= 2.0.0 | Direct swap from v2.x |
Networking & Edge
Databases, Caching & Analytics
| Module | Supported Versions | Notes |
|---|
| DMS | >= 2.0.0 | Direct swap from v2.x |
| DynamoDB Table | >= 5.0.0 | Direct swap from v5.x |
| ElastiCache | >= 1.0.0, < 2.0.0 | v1.x only |
| OpenSearch | >= 2.0.0, < 3.0.0 | v2.x only |
| RDS | >= 7.0.0 | Direct swap from v7.x |
| RDS Aurora | >= 10.0.0, < 11.0.0 | v10.x only |
| Redshift | >= 7.0.0, < 8.0.0 | v7.x only |
| EMR | >= 3.0.0 | Direct swap from v3.x |
Security, Keys & Configuration
| Module | Supported Versions | Notes |
|---|
| ACM | >= 6.0.0, < 7.0.0 | v6.x only |
| KMS | >= 4.0.0 | Direct swap from v4.x |
| Secrets Manager | >= 2.0.0 | Direct swap from v2.x |
| SSM Parameter | >= 2.0.0 | Direct swap from v2.x |
Messaging & Streaming
| Module | Supported Versions | Notes |
|---|
| MSK Kafka Cluster | >= 3.0.0 | Direct swap from v3.x |
| SNS | >= 7.0.0 | Direct swap from v7.x |
| SQS | >= 5.0.0 | Direct swap from v5.x |
API & Application Integration
Observability
| Module | Supported Versions | Notes |
|---|
| CloudWatch | >= 5.0.0 | Direct swap from v5.x |
What if I am on an older version?
If your upstream module version is below the minimum supported version, upgrade the upstream module first (staying on terraform-aws-modules/...) and verify the upgrade is clean. Then change the source to compliance.tf.
Upgrading the upstream module and migrating to compliance.tf in a single step is not recommended. Separate the two changes so you can attribute any plan diff to the right cause.
What about newer versions?
Adapters with open-ended constraints (e.g., >= 5.0.0) support all future minor and patch releases of that major version. Adapters with upper bounds (e.g., >= 10.0.0, < 11.0.0) are pinned to a single major version. When a new major version of the upstream module is released, a new adapter is added to compliance.tf.