Getting Started with Operational Rules

Operational Rules apply your organization's operational standards — lifecycle blocks like prevent_destroy, tag ignore_changes, provisioner removal, instance type restrictions — to modules at download time, without forks or wrapper modules. They are independent from compliance controls: controls enforce regulatory requirements and run first, rules enforce operational standards and run second. See the Operational Rules overview for the full concept.

This guide takes you from viewing available rules to verifying they are applied. Typically under 5 minutes.

Prerequisites

Before you begin, make sure you have:

• A compliance.tf account. Start a free trial or sign in.
• Terraform >= 1.0 or OpenTofu >= 1.6 installed.
• A module source pointing at a compliance.tf registry endpoint (e.g., soc2.compliance.tf/...). See Get Started if you have not set this up yet.
• An access token configured via terraform login or .terraformrc. See Get Started for details.

Step 1: Browse available rules

Browse the full catalog of available rules at Rule Catalog. Each rule page shows what the rule does, which resources it affects, and example before/after HCL.

The 7 built-in rules are:

Step 2: Add rules to your module source

The simplest way to apply rules is to add the ?rules= query parameter to your HTTPS module source URL. No API calls needed. Just add the rules you want directly in your Terraform configuration:

module "s3_bucket" {
  source = "https://soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws?version=5.0.0&rules=pofix/prevent_destroy_data,pofix/ignore_tag_changes,pofix/no_provisioners"
}

This works on all tiers and gives you per-module control over which rules are applied. Always include the namespace in rule ids (pofix/prevent_destroy_data, not prevent_destroy_data) — a name without its namespace matches nothing and is silently ignored. When org defaults exist (paid tier, below), prefix a rule with + to add it on top of the defaults or - to remove it for that download: ?rules=-pofix/prevent_destroy_data.

Paid tier: org-level defaults. On paid tiers, org admins configure default rules for the entire organization from the org dashboard at app.compliance.tf (backed by PUT /api/org/rules). This requires a signed-in dashboard session with the org admin role on a paid tier — it is separate from the ctf_ registry access token, which authenticates module downloads only. When org defaults are configured, rules are applied automatically to every module download without needing ?rules= in the URL. Individual developers can still override org defaults per-request using ?rules=.

Step 3: Verify rules are applied

Run terraform init -upgrade on any module sourced from the compliance.tf registry (-upgrade forces a fresh download past the local module cache):

terraform init -upgrade

Expected output:

Initializing modules...
Downloading soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws 5.0.0 for s3_bucket...
- s3_bucket in .terraform/modules/s3_bucket

Initializing provider plugins...

Terraform has been successfully initialized!

After init completes, inspect the downloaded module to confirm rules were applied. For example, if you enabled Prevent Destroy Data, check the S3 bucket resource:

grep -B1 -A2 "prevent_destroy" .terraform/modules/s3_bucket/main.tf

Expected output:

  lifecycle {
    prevent_destroy = true
  }

The lifecycle block is now in the module source code. It was not there in the upstream terraform-aws-modules version.

Rules manifest (coming soon)

Troubleshooting

module "s3_bucket" {
  source = "https://soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws?version=5.0.0&rules=-pofix/prevent_destroy_data"
}

Next steps

• Rule Catalog — all 7 rules with before/after examples
• Operational Rules overview — how rules interact with compliance controls, FAQ
• Preview Rule Diffs (coming soon) — see what a rule changes before downloading