How is this different from OPA or Sentinel?

OPA and Sentinel are policy engines where you write rules in Rego or Sentinel language. With compliance.tf, compliance controls are pre-built into the modules — no policy authoring or engine deployment needed. Many teams use both. Starting Q2 2026, compliance.tf custom rules can scan, edit, and enforce organizational policies directly in the modules.

Which Terraform modules are available today?

34 modules based on terraform-aws-modules, including S3, VPC, EKS, RDS, Lambda, ALB, DynamoDB, and more. Same variables, same outputs, same interface. Custom module support is in beta.

Does this work with OpenTofu, Terragrunt, or Terramate?

Yes. Our registry uses the standard Terraform module protocol, which OpenTofu supports natively. Run tofu login registry.compliance.tf instead of terraform login and everything else works the same way. Terragrunt and Terramate orchestrate runs without changing how modules are resolved, so they work out of the box.

What does Compliance.tf cover vs. what do I still own?

We enforce controls at the Terraform module level — encryption, logging, versioning, access blocking for 34 AWS modules. You still own IAM policies, network architecture, application security, runtime monitoring, and incident response.

What if I need to disable a control for a legitimate reason?

Disable specific controls via a query parameter in the module source. Every exception is logged with the control ID, who authorized it, and why.

Does this replace Vanta, Drata, or Sprinto?

No. We enforce controls inside Terraform modules. Your GRC platform tracks policies, collects evidence, and manages audit workflows. We feed evidence into your GRC platform, not the other way around.

How do I get started?

Sign up at compliance.tf — no AWS account or credit card required. Run terraform login registry.compliance.tf, change your module source line, and run terraform init. If you use OpenTofu, run tofu login registry.compliance.tf instead. You can also subscribe through AWS Marketplace.

What if Compliance.tf shuts down or I want to leave?

Our modules are standard Terraform. They work with Terraform, OpenTofu, Terragrunt, Terramate, and any tool that speaks the Terraform module protocol. Every module is a drop-in replacement for upstream terraform-aws-modules (same variables, same outputs). Change your module source back and run terraform init. No lock-in, no proprietary state.

FedRAMP Compliant Terraform Modules
Enforced Before `terraform apply`

FedRAMP Moderate includes 325 NIST 800-53 controls. The subset tied to AWS infrastructure configuration is enforced before deployment, so your 3PAO assessment starts clean.

If you sell cloud services to US federal agencies, FedRAMP authorization is required. The Moderate baseline (325 controls) covers most SaaS applications that handle non-classified government data.

145

Controls

Clauses

AWS Modules

Start Free Trial View All Controls

No credit card or AWS account needed to start.

From the team behind terraform-aws-modules. 2B+ provisions worldwide.

IAM · S3 · RDS · General · VPC · EC2|SOC 2 Type II Certified|Available on AWS Marketplace

Three Steps to FedRAMP Compliant Infrastructure

For terraform-aws-modules users, migration is a one-line change. Same workflow, same interface. Bringing your own modules? We can make those compliant too. Join the beta.

Change One Line

main.tf

module "s3" {
- source = "registry.terraform.io/..."
+ source = "fedrampmoderate.compliance.tf/..."
 
  bucket = "awesome-docs"
}

Run Terraform Commands

terminal

$ terraform init
Initializing modules...
- module.s3 in fedrampmoderate.compliance.tf/...
Terraform has been successfully initialized!
$ terraform apply
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Compliance Enforced

AU-11 · Versioning + Lifecycle

SC-28(1) · KMS Encryption

SC-28 · Default Encryption

SC-8 · SSL Requests Only

AU-3 · Logging Enabled

CP-9 · Cross-Region Replication

AC-3 · Block Public Read

AC-3 · Block Public Write

Every compliance requirement you define is enforced automatically. Nothing to scan, nothing to remediate.

Controls Enforced for FedRAMP

145 controls across 36 clauses and AWS services

Enforced (10)Detected (19)

Additional Controls

116 additional controls enforced for FedRAMP

Enforced (59)Detected (57)

View full control documentation with implementation details

View FedRAMP reference documentation

FedRAMP Scope: What We Handle vs. What You Own

compliance.tf handles the infrastructure configuration layer for FedRAMP. Here is what it covers and what stays with your team.

compliance.tf Enforces for FedRAMP

Infrastructure-level FedRAMP Moderate baseline controls
NIST 800-53-based control mapping with specific control IDs
Deployment-time evidence generation via AWS-native tools
Upstream module updates (terraform-aws-modules kept in sync)
Exception management with audit trail
Control documentation and baseline mapping matrices

See which modules are covered

View FedRAMP reference documentation

Your Team Still Handles for FedRAMP

3PAO assessment engagement and coordination
System Security Plan (SSP) documentation
Plan of Action and Milestones (POA&M) management
Continuous monitoring program implementation
Incident response and reporting to FedRAMP PMO
Personnel security and access authorization
Physical and environmental protection controls

compliance.tf covers the technical infrastructure controls in the FedRAMP Moderate baseline. Your 3PAO still assesses your full authorization boundary, but the infrastructure configuration layer is already compliant.

FedRAMP Audit Evidence, Generated Automatically

Your auditor does not need to trust compliance.tf. Evidence comes from AWS-native tools they already accept.

Evidence your auditor already trusts

Every compliance.tf module enforces controls at deploy time. When AWS Config, Security Hub, or Audit Manager evaluates your resources, they report clean findings because the controls are built into the modules, not bolted on after the fact.

AWS Config rules validate resource configuration continuously
Security Hub aggregates findings across accounts and regions
Audit Manager generates assessment reports mapped to FedRAMP
Downloadable control mapping matrices for your auditor

evidence.json

{
    "framework": "FedRAMP",
    "clause": "SC-28",
    "control": "s3_bucket_default_encryption_enabled",
   "status": "COMPLIANT",
    "source": "AWS Config",
    "resource": "arn:aws:s3:::awesome-docs",
    "evaluated": "2026-03-04T10:30:00Z"
}

Prevention vs. Detection for FedRAMP

compliance.tf prevents non-compliant deployments. Scanning tools detect them after the fact. Most mature programs use both.

Dimension	IaC Scanning Checkov / Trivy / Prowler	compliance.tf
Prevents non-compliant configs before terraform apply	No (post-plan scan)	Yes
Maps controls to framework clause IDs	Partial	Yes
Produces auditor-accepted evidence (AWS-native)	Scan reports only	Yes
Exception management with audit trail	Suppression rules	Yes
Same interface as terraform-aws-modules	N/A	Yes
Keeps pace with upstream module updates	N/A	Yes
Catches runtime drift / console changes	Yes	No
Covers non-Terraform resources	Yes	No
Internal engineering time	Medium	Low

We recommend keeping scanning tools active alongside compliance.tf for defense in depth. The scanner validates what compliance.tf already enforces.

FedRAMP Compliance Questions

Which FedRAMP baseline does this cover?

compliance.tf maps controls to the FedRAMP Moderate baseline (Rev 4), which includes 325 controls from NIST 800-53. We cover the subset of those controls that map to AWS resource configuration — primarily Access Control, Audit, System Protection, and Contingency Planning families.

Does this help with FedRAMP authorization?

compliance.tf ensures your AWS infrastructure meets the technical controls required for FedRAMP authorization. It does not replace the authorization process itself — you still need a 3PAO assessment, SSP, and PMO review. What compliance.tf does is ensure your infrastructure controls are enforced before deployment, reducing findings during assessment.

How is this different from Checkov, Trivy, or Prowler?

Those tools are detective controls. They scan infrastructure after you write it and report findings you fix manually. compliance.tf is a preventive control. The modules themselves cannot produce non-compliant resources. There is nothing to scan, nothing to remediate. Most teams keep their scanners running alongside compliance.tf for defense in depth.

Can I adopt this gradually, or is it all-or-nothing?

Fully incremental. Start with one module in one environment. Your existing modules continue working untouched. If you use Terragrunt or Terramate to orchestrate your runs, nothing changes — you’re only swapping the module source line. There is no global policy agent to deploy, no wrapper binary, no sidecar. Each module source line is independent.

Will my auditor accept this as evidence?

Your auditor does not need to trust compliance.tf directly. Evidence comes from AWS-native tools they already accept: AWS Config, Security Hub, and Audit Manager. We enforce controls at deploy time so those AWS tools always report clean findings.

What if I want to switch back or compliance.tf shuts down?

Our modules are standard Terraform. They work with Terraform, OpenTofu, Terragrunt, Terramate, and any tool that speaks the Terraform module protocol. Every module is a drop-in replacement for its upstream terraform-aws-modules equivalent with the same variables and outputs. Change your module source line back, run terraform init. Your infrastructure does not change. No lock-in, no proprietary state.

Start Deploying FedRAMP-Compliant Infrastructure

$100/year for all 34 modules, all frameworks. 30-day free trial.

Start Free Trial Contact Sales

No credit card required. Switch back at any time.

Stay Informed About New Features

Join the mailing list for releases, new modules, and roadmap updates. No spam. Unsubscribe anytime.

Not convinced yet or dying for a feature we don't have? Send us an email — we really want to hear your feedback!

FedRAMP Compliant Terraform ModulesEnforced Before terraform apply

Three Steps to FedRAMP Compliant Infrastructure

Change One Line

Run Terraform Commands

Compliance Enforced

Controls Enforced for FedRAMP

AC-17 (3): Managed Access Control Points

AC-2 (3): Disable Inactive Accounts

AU-11: Audit Record Retention

AU-7 (1): Automatic Processing

CM-5 (5): Limit Production / Operational Privileges

CP-9: Information System Backup

IA-2 (2): Network Access To Non-Privileged Accounts

IA-2 (3): Local Access To Privileged Accounts

IA-5 (1): Password-Based Authentication

SC-28 (1): Cryptographic Protection

SC-7: Boundary Protection

SI-4 (5): System-Generated Alerts

Additional Controls

IAM

RDS

S3

ELB

VPC

EBS

EC2

CloudTrail

Redshift

API Gateway

Elasticsearch

Lambda

DynamoDB

SageMaker

Auto Scaling

CodeBuild

EFS

GuardDuty

KMS

SSM

ACM

Backup

CloudWatch

DMS

ECS

Elastic Beanstalk

ElastiCache

EMR

FSx

CloudWatch Logs

SNS

WAFv2