FedRAMP Compliant Terraform Modules
Enforced Before `terraform apply`

The FedRAMP Moderate baseline (Rev 4) includes 325 NIST 800-53 controls. The subset tied to AWS infrastructure configuration is enforced before deployment, so your 3PAO assessment starts clean.

If you sell cloud services to US federal agencies, FedRAMP authorization is required. The Moderate baseline (325 controls) covers most SaaS applications that handle non-classified government data.

Mapped Controls

70 enforced by modules

Clauses

AWS Modules

Start Free Trial View All Controls

No credit card or AWS account needed to start.

From the maintainer of terraform-aws-modules - 2B+ downloads.

IAM · RDS · S3 · VPC · ELB · CloudTrail|SOC 2 Type II report|Available on AWS Marketplace

Three Steps to FedRAMP Compliant Infrastructure

For terraform-aws-modules users, migration is a one-line change. Same workflow, same interface. Bringing your own modules? We can make those compliant too. Join the beta.

Change One Line

main.tf

module "s3" {
- source = "registry.terraform.io/..."
+ source = "fedrampmoderate.compliance.tf/..."
 
  bucket = "awesome-docs"
}

Browse FedRAMP modules at fedrampmoderate.compliance.tf →

Run Terraform Commands

terminal

$ terraform init
Initializing modules...
- module.s3 in fedrampmoderate.compliance.tf/...
Terraform has been successfully initialized!
$ terraform apply
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Compliance Enforced

AU-11 · Versioning + Lifecycle

SC-28 (1) · KMS Encryption

SC-28 · Default Encryption

SC-8 · SSL Requests Only

AU-3 · Logging Enabled

CP-9 · Versioning Enabled

AC-3 · Block Public Read

AC-3 · Block Public Write

Controls with module coverage are enforced automatically. Enforced controls ship as compliant defaults; mapped controls without module coverage stay visible for your team.

Controls Mapped for FedRAMP

96 controls mapped, 70 enforced by modules, across 98 clauses and AWS services

Enforced: the module configures this by default. Detected: mapped for visibility and evidence, not set by the module.

Enforced (54)Detected (90)

Additional Controls

50 additional controls mapped for FedRAMP

Enforced (16)Detected (34)

View full control documentation with implementation details

View FedRAMP reference documentation

FedRAMP Scope: What We Handle vs. What You Own

compliance.tf handles the infrastructure configuration layer for FedRAMP. Here is what it covers and what stays with your team.

compliance.tf Enforces for FedRAMP

Infrastructure-level FedRAMP Moderate baseline controls
NIST 800-53-based control mapping with specific control IDs
Deployment-time evidence generation via AWS-native tools
Upstream module updates (terraform-aws-modules kept in sync)
Exception management with audit trail
Control documentation and baseline mapping matrices

See which modules are covered

View FedRAMP reference documentation

Your Team Still Handles for FedRAMP

3PAO assessment engagement and coordination
System Security Plan (SSP) documentation
Plan of Action and Milestones (POA&M) management
Continuous monitoring program implementation
Incident response and reporting to FedRAMP PMO
Personnel security and access authorization
Physical and environmental protection controls

compliance.tf covers the technical infrastructure controls in the FedRAMP Moderate baseline. Your 3PAO still assesses your full authorization boundary, but the infrastructure configuration layer is already compliant.

Operational Rules (lifecycle blocks, tagging, instance restrictions) are also applied alongside FedRAMP compliance controls.

FedRAMP Audit Evidence - Built Into Your Workflow

Your auditor does not need to trust compliance.tf. Evidence comes from AWS-native tools they already accept.

Evidence your auditor already trusts

Every compliance.tf module enforces controls before terraform apply. When AWS Config, Security Hub, or Audit Manager evaluates your resources, they report clean findings because the controls are built into the modules, not bolted on after the fact.

AWS Config rules validate resource configuration continuously
Security Hub aggregates findings across accounts and regions
Audit Manager generates assessment reports mapped to FedRAMP
Downloadable control mapping matrices for your auditor

evidence.json

{
    "framework": "FedRAMP",
    "clause": "SC-28",
    "control": "s3_bucket_default_encryption_enabled",
   "status": "COMPLIANT",
    "source": "AWS Config",
    "resource": "arn:aws:s3:::awesome-docs",
    "evaluated": "2026-08-14T10:30:00Z"
}

Prevention vs. Detection for FedRAMP

compliance.tf prevents non-compliant deployments. Scanning tools detect them after the fact. Most mature programs use both.

Dimension	IaC Scanning Checkov / Trivy / Prowler	Compliance.tf
Prevents non-compliant configs before terraform apply	No (post-plan scan)	Yes
Maps controls to framework clause IDs	Partial	Yes
Produces auditor-accepted evidence (AWS-native)	Scan reports only	Yes
Exception management with audit trail	Suppression rules	Yes
Same interface as terraform-aws-modules	N/A	Yes
Keeps pace with upstream module updates	N/A	Yes
Catches runtime drift / console changes	Yes	No
Covers non-Terraform resources	Yes	No
Internal engineering time	Medium	Low

We recommend keeping scanning tools active alongside compliance.tf for defense in depth. The scanner validates what compliance.tf already enforces.

Detailed: compliance.tf vs Checkov/Trivy →Detailed: compliance.tf vs OPA/Sentinel →All comparisons →

FedRAMP Compliance Questions

Which FedRAMP baseline does this cover?

compliance.tf maps controls to the FedRAMP Moderate baseline (Rev 4), which includes 325 controls from NIST 800-53. We cover the subset of those controls that map to AWS resource configuration - primarily Access Control, Audit, System Protection, and Contingency Planning families.

Does this help with FedRAMP authorization?

compliance.tf ensures your AWS infrastructure meets the technical controls required for FedRAMP authorization. It does not replace the authorization process itself - you still need a 3PAO assessment, SSP, and PMO review. What compliance.tf does is ensure your infrastructure controls are enforced before deployment, reducing findings during assessment.

How is this different from Checkov, Trivy, or Prowler?

Those tools are detective controls. They scan infrastructure after you write it and report findings you fix manually. compliance.tf is a preventive control. The modules cannot silently produce non-compliant resources - every exception is an explicit parameter in your code, visible in review. Compliant defaults ship up front instead of findings to remediate later. Most teams keep their scanners running alongside compliance.tf for defense in depth.

Can I adopt this gradually, or is it all-or-nothing?

Fully incremental. Start with one module in one environment. Your existing modules continue working untouched. If you use Terragrunt or Terramate to orchestrate your runs, nothing changes - you’re only swapping the module source line. There is no global policy agent to deploy, no wrapper binary, no sidecar. Each module source line is independent.

Will my auditor accept this as evidence?

Your auditor does not need to trust compliance.tf directly. Evidence comes from AWS-native tools they already accept: AWS Config, Security Hub, and Audit Manager. We enforce controls before terraform apply, so those tools report the enforced controls as passing.

What if I want to switch back or compliance.tf shuts down?

Our modules are standard Terraform. They work with Terraform, OpenTofu, Terragrunt, Terramate, and any tool that speaks the Terraform module protocol. Every module is a drop-in replacement for its upstream terraform-aws-modules equivalent with the same variables and outputs. Change your module source line back, run terraform init. Your infrastructure does not change. No lock-in, no proprietary state.

From Our Blog

Make Non-Compliant Terraform Impossible

Replace scanning with built-in compliance controls

Start Deploying FedRAMP-Compliant Infrastructure

$1,000/year for all 35 modules, all frameworks. 30-day free trial.

Start Free Trial Contact Sales

No credit card required. Switch back at any time.

Or browse the FedRAMP registry first - no signup needed: fedrampmoderate.compliance.tf

Stay Informed About New Features

Join the mailing list for releases, new modules, and roadmap updates. No spam. Unsubscribe anytime.

Not convinced yet, or missing a feature you need? Send us an email - we really want to hear your feedback!

FedRAMP Compliant Terraform ModulesEnforced Before terraform apply

Three Steps to FedRAMP Compliant Infrastructure

Change One Line

Run Terraform Commands

Compliance Enforced

Controls Mapped for FedRAMP

AC-2 (3): Disable Inactive Accounts

AC-2(1) Automated System Account Management

AC-2-3

AC-2(4) Automated Audit Actions

AC-2(12)(a)

AC-2(f)

AC-2(g)

AC-2(j)

AC-5(c)

AC-6 (5): Privileged Accounts

AC-6(10) Prohibit Non-Privileged Users From Executing Privileged Functions

AC-12: Session Termination

AC-17 (3): Managed Access Control Points

AC-17(1) Automated Monitoring/Control

AC-17(2) Protection Of Confidentiality/Integrity Using Encryption

AC-21(b)

Access Enforcement (AC-3)

Application Partitioning (SC-2)

AU-2(a)(d)

AU-6(1)(3)

AU-7 (1): Automatic Processing

AU-7(1) Automatic Processing

AU-9 (2): Audit Backup On Separate Physical Systems / Components

AU-9(2) Audit Backup On Separate Physical Systems / Components

AU-11: Audit Record Retention

AU-12(a)(c)

Audit Record Retention (AU-11)

Automated Flaw Remediation Status (SI-2(2))

Baseline Configuration (CM-2)

Boundary Protection (SC-7)

CA-7(a)(b)

CM-5 (5): Limit Production / Operational Privileges

CM-7(a)

CM-8(1)

CM-8(3)(a)

Content of Audit Records (AU-3)

CP-9: Information System Backup

CP-9(b))

Cryptographic Key Establishment And Management (SC-12)

Denial Of Service Protection (SC-5)

Developer Configuration Management (SA-10)

IA-2 (2): Network Access To Non-Privileged Accounts

IA-2(1) Network Access To Privileged Accounts

IA-2(1)(2)

IA-5 (1): Password-Based Authentication

IA-5(1)(a)(d)(e)

IA-5(4) Automated Support For Password Strength Determination

Identification and Authentication (Organizational users) (IA-2)

Information Flow Enforcement (AC-4)

Information Handling and Retention (SI-12)

Information In Shared Resources (SC-4)

Information System Recovery And Reconstitution (CP-10)

IR-4(1) Automated Incident Handling Processes

IR-6(1) Automated Reporting

IR-7(1) Automation Support For Availability Of Information / Support

Least Privilege (AC-6)

Protection of Audit Information (AU-9)

Protection of Information at Rest (SC-28)

RA-5: Vulnerability Scanning

SA-3(a)

SC-7: Boundary Protection

SC-7(3) Access Points

SC-8 (1): Cryptographic Or Alternate Physical Protection

SC-8(1) Cryptographic Or Alternate Physical Protection

SC-28 (1): Cryptographic Protection

Session Authenticity (SC-23)

SI-4: Information System Monitoring

SI-4(1) System-Wide Intrusion Detection System

SI-4(2) Automated Tools For Real-Time Analysis

SI-4(4) Inbound and Outbound Communications Traffic

SI-4(5) System-Generated Alerts

SI-4(16) Correlate Monitoring Information

SI-4(a)(b)(c)

SI-7(1) Integrity Checks

FedRAMP Compliant Terraform Modules
Enforced Before `terraform apply`