Terraform AWS EC2 Instance

EC2 instances with IAM roles, EBS encryption, IMDSv2, security groups, detailed monitoring, user data, placement options, and optional Elastic IPs or attached volumes.

16 controls enforced26 frameworks

Controls Enforced

The following compliance controls are enforced by this module at terraform plan time.

Attached EBS volumes should have encryption enabled low effort
EBS volumes should have encryption at rest enabled low effort
EC2 instances should have attached EBS volumes marked for deletion on termination low effort
EC2 instances should have detailed monitoring enabled low effort
EC2 instances should have EBS optimization enabled low effort
EC2 instances should have IAM profile attached low effort
EC2 instances should be in a VPC low effort
EC2 instances should not use key pairs in running state low effort
EC2 instances should not have a public IP address low effort
EC2 instances should not use multiple ENIs low effort
EC2 instances should have termination protection enabled low effort
EC2 instances should use IMDSv2 low effort
EC2 instances should use IAM instance roles for AWS resource access low effort
EC2 instances should not use paravirtual instance types low effort
VPC Security groups should only allow unrestricted incoming traffic for authorized ports low effort
VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888 low effort

Quick Start

ACSC Essential EightACSC ISM March 2023AWS Control Tower GuardrailsAWS Generative AI Best Practices v2AWS Well-Architected Framework v10CCCS Medium Cloud Control ProfileTitle 21 CFR Part 11CIS AWS Benchmark v1.4.0CIS AWS Benchmark v5.0.0CIS AWS Benchmark v6.0.0CIS Controls v8.0 IG1CISA Cyber EssentialsEU GMP Annex 11FedRAMP Low Baseline Rev 4FedRAMP Moderate Baseline Rev 4FFIEC Cybersecurity Assessment ToolGDPRHIPAA Omnibus Rule 2013ISO/IEC 27001:2022NIS2 Directive (EU 2022/2555)NIST SP 800-171 Rev 2NIST SP 800-53 Rev 5NIST Cybersecurity Framework v2.0NYDFS Cybersecurity RegulationPCI DSS v4.0RBI Cyber Security Framework for UCBsRBI IT Framework for NBFCsSOC 2

module "ec2_instance" {
  source  = "acscessentialeight.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "acscism2023.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "awscontroltower.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "awsgenai.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "awswellarchitected.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "cccsmedium.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "cisv140.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "cisv500.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "cis.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "cisv80ig1.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "cisacyberessentials.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "fedramplow.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "fedrampmoderate.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "ffiec.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "gdpr.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "hipaa.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "iso27001.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "nis2.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "nist800171.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "nist80053.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "nydfs23.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "rbicybersecurity.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "rbiitfnbfc.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

module "ec2_instance" {
  source  = "soc2.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "<version>"

  # ... your arguments here
}

See the Get Started guide to get started and read the Features section for more details on how to customize the module for your requirements.

Migration from Upstream

Already using terraform-aws-modules? Change only the source URL:

BeforeAfter

module "ec2_instance" {
  source  = "terraform-aws-modules/ec2-instance/aws"
  version = "1.0"
}

module "ec2_instance" {
  source  = "soc2.compliance.tf/terraform-aws-modules/ec2-instance/aws"
  version = "1.0"
}

Same arguments. Same outputs. Compliance controls are enforced automatically at terraform plan. If a required value is missing, you get a clear validation error telling you what to set.

See the Migration Guide for step-by-step instructions.

Reversibility

No lock-in. Switch back by reverting the source URL to the upstream path:

module "ec2_instance" {
  source  = "terraform-aws-modules/ec2-instance/aws"
}

Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Mapped compliance frameworks

Framework Coverage

Which controls from this module are active under each framework endpoint. ● enforced by default · ○ not activated by this endpoint

Control	NIST SP 800-171 Rev 2	PCI DSS v4.0	ISO/IEC 27001:2022	NIST SP 800-53 Rev 5	Title 21 CFR Part 11	FedRAMP Moderate Baseline Rev 4	HIPAA Omnibus Rule 2013	SOC 2
Attached EBS volumes should have encryption enabled	●	●	●	●	●	●	●	●
EBS volumes should have encryption at rest enabled	●	●	●	●	●	●	●	●
EC2 instances should have attached EBS volumes marked for deletion on termination	○	○	○	○	○	○	○	○
EC2 instances should have detailed monitoring enabled	●	●	○	○	○	●	●	●
EC2 instances should have EBS optimization enabled	●	○	○	●	●	●	●	●
EC2 instances should have IAM profile attached	●	●	●	●	●	○	●	○
EC2 instances should be in a VPC	●	●	○	●	●	●	●	●
EC2 instances should not use key pairs in running state	○	●	○	○	○	○	○	○
EC2 instances should not have a public IP address	●	●	●	●	●	●	●	●
EC2 instances should not use multiple ENIs	○	○	●	○	○	○	○	○
EC2 instances should have termination protection enabled	○	○	○	○	○	○	○	○
EC2 instances should use IMDSv2	●	●	●	●	●	●	●	●
EC2 instances should use IAM instance roles for AWS resource access	●	●	●	●	●	○	○	○
EC2 instances should not use paravirtual instance types	○	○	●	○	○	○	○	○
VPC Security groups should only allow unrestricted incoming traffic for authorized ports	●	●	○	●	○	●	○	○
VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888	○	○	●	○	○	○	○	●

Showing top 8 frameworks by coverage. All framework endpoints →