compliance.tf
Terraform Modules for AWSStorage

Terraform AWS S3 Bucket

S3 buckets with versioning, default encryption, public access blocks, bucket policies, access logging, lifecycle rules, replication, event notifications, and optional object lock controls.

Controls enforced

These compliance controls are checked at terraform plan time.

Quick start

module "s3-bucket" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">= 5.0.0"

  # ... your arguments here
}
module "s3-bucket" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">= 5.0.0"

  # ... your arguments here
}
module "s3-bucket" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">= 5.0.0"

  # ... your arguments here
}
module "s3-bucket" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">= 5.0.0"

  # ... your arguments here
}
module "s3-bucket" {
  source  = "soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">= 5.0.0"

  # ... your arguments here
}
module "s3-bucket" {
  source  = "fedrampmoderate.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">= 5.0.0"

  # ... your arguments here
}
module "s3-bucket" {
  source  = "awswellarchitected.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">= 5.0.0"

  # ... your arguments here
}
module "s3-bucket" {
  source  = "iso27001.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">= 5.0.0"

  # ... your arguments here
}

View this module on the compliance.tf registry — versions, inputs, and outputs →

See the Get Started guide and Registry Endpoints for details on how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "s3-bucket" {
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = ">= 5.0.0"
}
module "s3-bucket" {
  source  = "soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">= 5.0.0"
}

Same arguments. Same outputs. Controls are checked at terraform plan. See the Migration Guide for step-by-step instructions.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "s3-bucket" {
  source  = "terraform-aws-modules/s3-bucket/aws"
}

Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Mapped compliance frameworks

1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks

10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.3.1: Audit logs are protected from destruction and unauthorized modifications.

10.3.3: Audit log files, including those for externalfacing technologies, are promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify

10.5.1: Audit log history is retained and available for analysis.

10.5.1: Retain audit log history for at least 12 months, with at least the most recent three months immediately available for analysis

10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.

11.5.2: A change-detection mechanism (for example, file integrity monitoring tools) is deployed

11.6.1: Unauthorized changes on payment pages are detected and responded to.

12.10.5: The security incident response plan includes monitoring and responding to alerts from security monitoring systems

3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.

3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.

3.3.2: Sensitive authentication data (SAD) is not stored after authorization.

3.3.3: Sensitive authentication data (SAD) is not stored after authorization.

3.5.1: Primary account number (PAN) is secured wherever it is stored.

5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.

7.2.1: Access to system components and data is appropriately defined and assigned.

7.2.2: Access to system components and data is appropriately defined and assigned.

7.2.5: Access to system components and data is appropriately defined and assigned.

7.2.6: Access to system components and data is appropriately defined and assigned.

7.3.1: Access to system components and data is managed via an access control system(s).

7.3.2: Access to system components and data is managed via an access control system(s).

7.3.3: Access to system components and data is managed via an access control system(s).

8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.

8.2.8: If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session

8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components

8.3.4: Strong authentication for users and administrators is established and managed.

8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.

8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.

8.4.3 MFA is implemented for all remote access originating from outside the entity's network that could access or impact the CDE

A1.2.3: Processes or mechanisms are implemented for reporting and addressing suspected or confirmed security incidents and vulnerabilities

A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.

A3.5.1: Suspicious events are identified and responded to.

12.4 Security - Audit Trail

11.10(a) Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records

11.10(a): Controls for closed systems

11.10(e) Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records

11.10(e): Controls for closed systems

11.10(g) Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand

11.10(k) Use of appropriate controls over systems documentation that includes adequate controls over the distribution of, access to, and use of documentation for system operation and maintenance

A1.2 The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data back-up processes, and recovery infrastructure to meet its objectives

C1.1 The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality

C1.1: The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality.

C1.2 The entity disposes of confidential information to meet the entity's objectives related to confidentiality

CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives

CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.

CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.

CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures

CC7.4 The entity responds to identified security incidents by executing a defined incident response program to understand, contain, remediate, and communicate security incidents, as appropriate

PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements

PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements

AC-2(4) Automated Audit Actions

AU-9(2) Audit Backup On Separate Physical Systems / Components

Content of Audit Records (AU-3)

Information Handling and Retention (SI-12)

Information System Recovery And Reconstitution (CP-10)

SEC08-BP04: Enforce access control

SUS04-BP03: Use policies to manage the lifecycle of your datasets

A.8.14 Redundancy of information processing facilities

Framework coverage

Which controls from this module are active under each framework endpoint.

ControlPCI DSS v4.0SOC 2
S3 buckets should not use ACLs for user access control●○
S3 buckets should have cross-region replication enabled○●
S3 buckets should have default encryption enabled●●
S3 buckets should have default encryption enabled using KMS○○
S3 buckets should have event notifications enabled●●
S3 buckets should have lifecycle policies configured●○
S3 buckets should have logging enabled●●
S3 buckets should have MFA delete enabled●○
S3 buckets should not be accessible to all authenticated users●●
S3 bucket Object Lock should use COMPLIANCE retention mode○○
S3 buckets should have object lock enabled●●
S3 buckets should have policies that prohibit public access○○
S3 buckets should restrict cross-account permissions●○
S3 buckets should prohibit public read access●●
S3 buckets should prohibit public write access●●
S3 buckets should have static website hosting disabled○●
S3 buckets with versioning enabled should have lifecycle policies configured●●
S3 buckets should have versioning enabled●●
S3 public access should be blocked at account level○●
S3 public access should be blocked at bucket level●○

● enforced by default · ○ not activated by this endpoint

Known Terraform limitations

Separately from the controls above, some things people ask this module for cannot be implemented by any module in any registry - they are limits of Terraform itself. Known limitations for this module lists the recurring ones: what causes each, the native workaround in full, and - where one exists - the opt-in Operational Rule that removes the need for a fork.

FSx

Previous Page

Autoscaling

Next Page

On this page

Controls enforcedQuick startMigration from upstreamReversibilityMapped compliance frameworksFramework coverageKnown Terraform limitations

Ask AI about this

Help improve this page