Getting Started with Operational Rules

From viewing available rules to verifying they are applied. Typically under 5 minutes.

Prerequisites

Before you begin, make sure you have:

• A compliance.tf account. Start a free trial or sign in.
• Terraform >= 1.0 or OpenTofu >= 1.6 installed.
• A module source pointing at a compliance.tf registry endpoint (e.g., soc2.compliance.tf/...). See Get Started if you have not set this up yet.
• An access token configured via terraform login or .terraformrc. See Get Started for details.

Step 1: Browse available rules

Browse the full catalog of available rules at Rule Catalog. Each rule page shows what the rule does, which resources it affects, and example before/after HCL.

The 7 builtin rules are:

Step 2: Add rules to your module source

The simplest way to apply rules is to add the ?rules= query parameter to your HTTPS module source URL. No API calls needed. Just add the rules you want directly in your Terraform configuration:

module "s3_bucket" {
  source = "https://soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws?version=5.0.0&rules=pofix/prevent_destroy_data,pofix/ignore_tag_changes,pofix/no_provisioners"
}

This works on all tiers and gives you per-module control over which rules are applied.

Paid tier: org-level defaults. On paid tiers, org admins can configure default rules for the entire organization via the compliance.tf API (PUT app.compliance.tf/api/org/rules with session auth). When org defaults are configured, rules are applied automatically to every module download without needing ?rules= in the URL. Individual developers can still override org defaults per-request using ?rules=.

Step 3: Verify rules are applied

Run terraform init on any module sourced from the compliance.tf registry:

terraform init -upgrade

Expected output:

Initializing modules...
Downloading soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws 5.0.0 for s3_bucket...
- s3_bucket in .terraform/modules/s3_bucket

Initializing provider plugins...

Terraform has been successfully initialized!

After init completes, inspect the downloaded module to confirm rules were applied. For example, if you enabled Prevent Destroy Data, check the S3 bucket resource:

grep -A2 "prevent_destroy" .terraform/modules/s3_bucket/main.tf

Expected output:

  lifecycle {
    prevent_destroy = true
  }

The lifecycle block is now in the module source code. It was not there in the upstream terraform-aws-modules version.

Step 4: Inspect the rules manifest (coming soon)

Troubleshooting

module "s3_bucket" {
  source = "https://soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws?version=5.0.0&rules=-pofix/prevent_destroy_data"
}