FedRAMP Moderate controls built into your Terraform modules. Enforced before apply.
Your 3PAO assesses the infrastructure controls of the FedRAMP Moderate baseline on AWS. The modules enforce these controls before apply and list the baseline control ID each one maps to, where the catalog names one.
Modules enforce 71 of 96 FedRAMP Moderate controls in the catalog. Of the 65 that cite a FedRAMP Moderate clause, they enforce 44. The controls they do not enforce stay with your team, with your SSP, POA&M, continuous monitoring and the 3PAO assessment.
No credit card or AWS account needed to start. By Anton Babenko, maintainer of terraform-aws-modules, more than 2 billion provisions.
Annex G: FedRAMP Moderate
- Framework
- FedRAMP Moderate baseline, Rev 4
- For
- Your team, on Terraform
Scope for FedRAMP Moderate
If you sell cloud services to US federal agencies, you need FedRAMP authorization. The Moderate baseline covers most SaaS that handles non-classified government data.
Covers
- Infrastructure controls on AWS resources that map to FedRAMP Moderate baseline control IDs, by control family in G.3.
- terraform-aws-modules through the FedRAMP Moderate framework host or your org endpoint, and resources written by hand outside modules once your team switches to the compliance.tf provider.
Stays with your team
- 3PAO assessment engagement and coordination.
- System Security Plan (SSP) documentation.
- Plan of Action and Milestones (POA&M) management.
- Continuous monitoring program.
- Incident response and reporting to the FedRAMP PMO.
- Personnel security and access authorization.
- Physical and environmental protection.
- Resources outside compliance.tf module coverage, and every control G.4 lists as Mapped: 21 with a FedRAMP Moderate clause and 4 without one.
The source line
Point a module at the FedRAMP Moderate framework host. Same inputs and outputs, no state migration. Terraform 1.0 or later.
- source = "terraform-aws-modules/s3-bucket/aws" + source = "fedrampmoderate.compliance.tf/terraform-aws-modules/s3-bucket/aws" version = "~> 5.0"
With an org endpoint, the source names your org host instead, and FedRAMP Moderatecomes from your org's configuration.
Enforced and mapped, by control family
Of the 65 FedRAMP Moderate controls in the documented catalog that cite a clause, modules enforce 44. A control appears once under each control family it maps to.
The catalog maps 31 more controls to FedRAMP Moderate without naming a clause, 27 of them enforced. They are listed apart at the end of G.4 and left out of these counts.
Every row is a control your 3PAO can look up.
Filter the register, or search by control name or clause, for example SC-28.
65 of 65 shown
Each control links to its public docs page.
- Enforced
- Modules set this control before anything is deployed.
- Mapped
- Documented on its docs page, not set by modules. Your team owns it.
Control register
Enforced or mapped without a named FedRAMP Moderate clause
The catalog lists these 31 controls under FedRAMP Moderate but names no FedRAMP Moderate clause for them, so the register and the counts in G.3 leave them out. Each still links to its docs page.
Clause IDs for the 3PAO. Your stack stays as it is.
Compliance.tf works alongside your scanners, plan policy, CSPM and GRC tool. It sets the controls in the modules and lists the clause each one is there for.
Evidence
What compliance.tf gives your 3PAO
- The FedRAMP Moderate clause IDs behind each enforced setting, with stable control IDs and public docs pages.
- The config snapshot bound to each environment, and the per-action audit log of promotions between environments.
What comes from your AWS account and GRC tool
Evidence of what actually runs comes from your own account, for example AWS Config and your CSPM. Your GRC tool keeps tracking policies and audit workflows.
Related reading
Make Non-Compliant Terraform Impossible, the comparisons with other tools, and the FedRAMP Moderate framework registry at fedrampmoderate.compliance.tf.
Plans for FedRAMP Moderate
FedRAMP Moderate is in the 30-day trial and in Full Access, $1,000 a year on AWS Marketplace. Schedule of fees.
Questions about FedRAMP Moderate
Which FedRAMP baseline does this cover?
Compliance.tf maps controls to the FedRAMP Moderate baseline (Rev 4), which includes 325 controls from NIST 800-53. We cover the subset of those controls that map to AWS resource configuration, for example in the Access Control (AC), Audit and Accountability (AU), System and Communications Protection (SC), and Contingency Planning (CP) families.
Can I adopt this gradually, or is it all-or-nothing?
Fully incremental. Start with one module in one environment. Your existing modules continue working untouched. If you use Terragrunt or Terramate to orchestrate your runs, nothing changes - you're only swapping the module source line. There is no global policy agent to deploy, no wrapper binary, no sidecar. Each module source line is independent.
What if we want to switch back?
Each module keeps the inputs and outputs of its terraform-aws-modules counterpart and needs no state migration, so switching back is the same source line change in reverse.