Terraform AWS KMS

Controls enforced

These compliance controls are checked at terraform plan time.

• KMS CMK rotation should be enabled(low effort)

Quick start

module "kms" {
  source  = "awswellarchitected.compliance.tf/terraform-aws-modules/kms/aws"
  version = ">= 4.0.0"

  # ... your arguments here
}

module "kms" {
  source  = "cccsmedium.compliance.tf/terraform-aws-modules/kms/aws"
  version = ">= 4.0.0"

  # ... your arguments here
}

module "kms" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/kms/aws"
  version = ">= 4.0.0"

  # ... your arguments here
}

module "kms" {
  source  = "cisv140.compliance.tf/terraform-aws-modules/kms/aws"
  version = ">= 4.0.0"

  # ... your arguments here
}

module "kms" {
  source  = "cisv500.compliance.tf/terraform-aws-modules/kms/aws"
  version = ">= 4.0.0"

  # ... your arguments here
}

module "kms" {
  source  = "cis.compliance.tf/terraform-aws-modules/kms/aws"
  version = ">= 4.0.0"

  # ... your arguments here
}

module "kms" {
  source  = "cisv80ig1.compliance.tf/terraform-aws-modules/kms/aws"
  version = ">= 4.0.0"

  # ... your arguments here
}

module "kms" {
  source  = "cisacyberessentials.compliance.tf/terraform-aws-modules/kms/aws"
  version = ">= 4.0.0"

  # ... your arguments here
}

View this module on the compliance.tf registry — versions, inputs, and outputs →

See the Get Started guide and Registry Endpoints for details on how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "kms" {
  source  = "terraform-aws-modules/kms/aws"
  version = ">= 4.0.0"
}

module "kms" {
  source  = "soc2.compliance.tf/terraform-aws-modules/kms/aws"
  version = ">= 4.0.0"
}

Same arguments. Same outputs. Controls are checked at terraform plan. See the Migration Guide for step-by-step instructions.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "kms" {
  source  = "terraform-aws-modules/kms/aws"
}

Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Mapped compliance frameworks

Framework coverage

Which controls from this module are active under each framework endpoint.

● enforced by default · ○ not activated by this endpoint

Known Terraform limitations

Separately from the controls above, some things people ask this module for cannot be implemented by any module in any registry - they are limits of Terraform itself. Known limitations for this module lists the recurring ones: what causes each, the native workaround in full, and - where one exists - the opt-in Operational Rule that removes the need for a fork.