compliance.tf

Operational Rules Catalog

The Operational Rules documented on this site. Each one is applied during terraform init. No forks, no wrapper modules.


Prevent Destroy Data

Adds prevent_destroy = true to data-bearing resources. Blocks accidental deletion of S3 buckets, RDS instances, Aurora clusters, DynamoDB tables, EFS file systems, and ElastiCache replication groups.

S3RDSAuroraDynamoDBEFSElastiCache
Ignore Tag Changes

Adds ignore_changes for tags and tags_all on all resources. Prevents Terraform from reverting tags managed by AWS Config, Service Catalog, or external automation.

All AWS resources
Ignore Selected Tag Keys

Adds ignore_changes for the tag keys your organization names, and nothing else. Silences a scanner's or inventory agent's tag while every other tag stays managed.

S3
Ignore Autoscaling Changes

Adds ignore_changes for read_capacity and write_capacity on DynamoDB tables. Prevents Terraform from reverting autoscaler adjustments on every plan.

DynamoDB
Ignore AMI Changes

Adds ignore_changes for the ami and image_id attributes on EC2 instances and launch templates. Prevents Terraform from forcing instance replacement when an AMI lookup resolves to a newer image.

EC2Launch templates
Prevent Destroy Encryption

Adds prevent_destroy = true to encryption key resources. Protects KMS keys and Secrets Manager secrets from accidental deletion.

KMSSecrets Manager
No Provisioners

Removes all provisioner blocks from all resources. Provisioners bypass the declarative model and introduce hidden side effects.

All resources
Allowed Regions

Adds a validation block to the module's region variable, so a region outside your organization's allowlist is rejected before anything is created.

All AWS resources
Restrict Instance Types

Denies GPU and specialty EC2 instance types (p3, p4, x1, x2, u-*). Prevents surprise compute bills from expensive instance families.

EC2
Create Before Destroy

Adds create_before_destroy = true to security groups and ACM certificates. The replacement exists before the old resource is destroyed, so an attached interface or listener keeps working.

VPCACM
Ignore Deployed Artifacts

Adds ignore_changes for the artifact pointer a pipeline rewrites: the Lambda zip, hash or image, and the ECS task definition revision. Terraform stops rolling deployments back.

LambdaECS
Ignore Scaling Changes

Adds ignore_changes for the capacity an autoscaler owns: desired_capacity on Auto Scaling groups, desired_size on EKS node groups, desired_count on ECS services. terraform-aws-eks and the terraform-aws-ecs service module already ignore these.

Auto ScalingEKSECS
Set EKS Node Group Desired Size

Opt-in. Lets Terraform change a terraform-aws-eks managed node group's desired, min and max size after create, with the AWS CLI from terraform_data. Needs the AWS CLI where terraform apply runs.

EKS
Ignore Secret Rotation

Adds ignore_changes for password on RDS instances and master_password on Aurora clusters. A credential that rotates outside Terraform stops showing as a diff on every plan.

RDSAurora
Set Deletion Protection

Sets the provider's deletion-protection attribute on RDS instances, Aurora clusters, DynamoDB tables and load balancers. AWS refuses the deletion, from Terraform, the console or the API.

RDSAuroraDynamoDBELB
Abort Incomplete Multipart Uploads

Adds a validation to the module's lifecycle_rule variable requiring an enabled rule that aborts incomplete multipart uploads within a bounded number of days. Rejected on your side before anything is created.

S3

How rules are applied

Rules are applied server-side during terraform init, at the same time as compliance controls. The downloaded module is standard Terraform HCL with the rule transformations already in place. See How rules work for the full flow.

Configuring rules for your organization

Org admins group the organization's rules into a Baseline that applies to every module and named rulesets a module selects with ?ruleset=. See Baseline rules and rulesets for the model and the Getting Started guide for setup.

On this page

Ask AI about this

Help improve this page