How is this different from OPA or Sentinel?

OPA and Sentinel are policy engines where you write rules in Rego or Sentinel language. With compliance.tf, compliance controls are pre-built into the modules — no policy authoring or engine deployment needed. Many teams use both. Starting Q2 2026, compliance.tf custom rules can scan, edit, and enforce organizational policies directly in the modules.

Which Terraform modules are available today?

34 modules based on terraform-aws-modules, including S3, VPC, EKS, RDS, Lambda, ALB, DynamoDB, and more. Same variables, same outputs, same interface. Custom module support is in beta.

Does this work with OpenTofu, Terragrunt, or Terramate?

Yes. Our registry uses the standard Terraform module protocol, which OpenTofu supports natively. Run tofu login registry.compliance.tf instead of terraform login and everything else works the same way. Terragrunt and Terramate orchestrate runs without changing how modules are resolved, so they work out of the box.

What does Compliance.tf cover vs. what do I still own?

We enforce controls at the Terraform module level — encryption, logging, versioning, access blocking for 34 AWS modules. You still own IAM policies, network architecture, application security, runtime monitoring, and incident response.

What if I need to disable a control for a legitimate reason?

Disable specific controls via a query parameter in the module source. Every exception is logged with the control ID, who authorized it, and why.

Does this replace Vanta, Drata, or Sprinto?

No. We enforce controls inside Terraform modules. Your GRC platform tracks policies, collects evidence, and manages audit workflows. We feed evidence into your GRC platform, not the other way around.

How do I get started?

Sign up at compliance.tf — no AWS account or credit card required. Run terraform login registry.compliance.tf, change your module source line, and run terraform init. If you use OpenTofu, run tofu login registry.compliance.tf instead. You can also subscribe through AWS Marketplace.

What if Compliance.tf shuts down or I want to leave?

Our modules are standard Terraform. They work with Terraform, OpenTofu, Terragrunt, Terramate, and any tool that speaks the Terraform module protocol. Every module is a drop-in replacement for upstream terraform-aws-modules (same variables, same outputs). Change your module source back and run terraform init. No lock-in, no proprietary state.

GDPR Compliant Terraform Modules
Enforced Before `terraform apply`

GDPR Article 32 requires technical measures to protect personal data. These modules enforce encryption at rest and in transit, access controls, and audit logging on every AWS resource before deployment.

If your application processes personal data of EU residents, GDPR applies regardless of where your company is based. Fines reach 4% of global annual turnover. US companies with European users are in scope.

Controls

AWS Modules

Start Free Trial View All Controls

No credit card or AWS account needed to start.

From the team behind terraform-aws-modules. 2B+ provisions worldwide.

IAM · CloudWatch Logs · CloudTrail · ELB · RDS · Redshift|SOC 2 Type II Certified|Available on AWS Marketplace

Three Steps to GDPR Compliant Infrastructure

For terraform-aws-modules users, migration is a one-line change. Same workflow, same interface. Bringing your own modules? We can make those compliant too. Join the beta.

Change One Line

main.tf

module "s3" {
- source = "registry.terraform.io/..."
+ source = "gdpr.compliance.tf/..."
 
  bucket = "awesome-docs"
}

Run Terraform Commands

terminal

$ terraform init
Initializing modules...
- module.s3 in gdpr.compliance.tf/...
Terraform has been successfully initialized!
$ terraform apply
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Compliance Enforced

Art. 32 · Default Encryption

Art. 32 · KMS Encryption

Art. 32 · SSL Requests Only

Art. 32 · EBS Encryption

Art. 32 · RDS Encryption

Art. 30 · CloudTrail Logging

Art. 32 · CloudFront HTTPS

Art. 5(1)(f) · Public Access Blocked

Every compliance requirement you define is enforced automatically. Nothing to scan, nothing to remediate.

Controls Enforced for GDPR

74 controls across 21 AWS services

Enforced (36)Detected (38)

View full control documentation with implementation details

View GDPR reference documentation

GDPR Scope: What We Handle vs. What You Own

compliance.tf handles the infrastructure configuration layer for GDPR. Here is what it covers and what stays with your team.

compliance.tf Enforces for GDPR

Encryption at rest and in transit for all supported AWS services
Access controls and public access blocking
Audit logging and trail validation
IAM policies and key rotation enforcement
Upstream module updates (terraform-aws-modules kept in sync)
Exception management with audit trail

See which modules are covered

View GDPR reference documentation

Your Team Still Handles for GDPR

Data Protection Officer (DPO) appointment
Data Protection Impact Assessments (DPIAs)
Consent management and legal basis documentation
Data subject requests: access, rectification, erasure (Art. 15-22)
Breach notification to supervisory authorities (Art. 33-34)
Data processor agreements (Art. 28)
Privacy policies and records of processing (Art. 30 organizational)

compliance.tf handles Article 32 technical measures: encryption, access controls, audit logging. Organizational GDPR requirements like consent management, DPIAs, data subject rights, and breach notification are your team's responsibility.

GDPR Audit Evidence, Generated Automatically

Your auditor does not need to trust compliance.tf. Evidence comes from AWS-native tools they already accept.

Evidence your auditor already trusts

Every compliance.tf module enforces controls at deploy time. When AWS Config, Security Hub, or Audit Manager evaluates your resources, they report clean findings because the controls are built into the modules, not bolted on after the fact.

AWS Config rules validate resource configuration continuously
Security Hub aggregates findings across accounts and regions
Audit Manager generates assessment reports mapped to GDPR
Downloadable control mapping matrices for your auditor

evidence.json

{
    "framework": "GDPR",
    "clause": "Art. 32",
    "control": "s3_bucket_default_encryption_enabled",
   "status": "COMPLIANT",
    "source": "AWS Config",
    "resource": "arn:aws:s3:::awesome-docs",
    "evaluated": "2026-03-04T10:30:00Z"
}

Prevention vs. Detection for GDPR

compliance.tf prevents non-compliant deployments. Scanning tools detect them after the fact. Most mature programs use both.

Dimension	IaC Scanning Checkov / Trivy / Prowler	compliance.tf
Prevents non-compliant configs before terraform apply	No (post-plan scan)	Yes
Maps controls to framework clause IDs	Partial	Yes
Produces auditor-accepted evidence (AWS-native)	Scan reports only	Yes
Exception management with audit trail	Suppression rules	Yes
Same interface as terraform-aws-modules	N/A	Yes
Keeps pace with upstream module updates	N/A	Yes
Catches runtime drift / console changes	Yes	No
Covers non-Terraform resources	Yes	No
Internal engineering time	Medium	Low

We recommend keeping scanning tools active alongside compliance.tf for defense in depth. The scanner validates what compliance.tf already enforces.

GDPR Compliance Questions

Which GDPR articles does this cover?

The controls map primarily to Article 32 (security of processing), which requires encryption, access controls, and the ability to restore data. Article 5(1)(f) (integrity and confidentiality principle) and Article 25 (data protection by design) also apply. These are the GDPR articles that translate directly to infrastructure configuration.

Does this make me GDPR compliant?

No. GDPR compliance requires organizational measures that no infrastructure tool can handle: appointing a DPO, conducting DPIAs, managing consent, responding to data subject requests, and notifying authorities of breaches within 72 hours. compliance.tf handles the Article 32 technical measures layer. You still need the rest.

We're a US company. Do we need GDPR modules?

If you process personal data of people in the EU, yes. GDPR applies based on whose data you handle, not where your company is located. A US SaaS product with European users is in scope.

How is this different from Checkov, Trivy, or Prowler?

Those tools are detective controls. They scan infrastructure after you write it and report findings you fix manually. compliance.tf is a preventive control. The modules themselves cannot produce non-compliant resources. There is nothing to scan, nothing to remediate. Most teams keep their scanners running alongside compliance.tf for defense in depth.

Can I adopt this gradually, or is it all-or-nothing?

Fully incremental. Start with one module in one environment. Your existing modules continue working untouched. If you use Terragrunt or Terramate to orchestrate your runs, nothing changes — you’re only swapping the module source line. There is no global policy agent to deploy, no wrapper binary, no sidecar. Each module source line is independent.

Will my auditor accept this as evidence?

Your auditor does not need to trust compliance.tf directly. Evidence comes from AWS-native tools they already accept: AWS Config, Security Hub, and Audit Manager. We enforce controls at deploy time so those AWS tools always report clean findings.

What if I want to switch back or compliance.tf shuts down?

Our modules are standard Terraform. They work with Terraform, OpenTofu, Terragrunt, Terramate, and any tool that speaks the Terraform module protocol. Every module is a drop-in replacement for its upstream terraform-aws-modules equivalent with the same variables and outputs. Change your module source line back, run terraform init. Your infrastructure does not change. No lock-in, no proprietary state.

Start Deploying GDPR-Compliant Infrastructure

$100/year for all 34 modules, all frameworks. 30-day free trial.

Start Free Trial Contact Sales

No credit card required. Switch back at any time.

Stay Informed About New Features

Join the mailing list for releases, new modules, and roadmap updates. No spam. Unsubscribe anytime.

Not convinced yet or dying for a feature we don't have? Send us an email — we really want to hear your feedback!

GDPR Compliant Terraform ModulesEnforced Before terraform apply

Three Steps to GDPR Compliant Infrastructure

Change One Line

Run Terraform Commands

Compliance Enforced

Controls Enforced for GDPR

IAM

CloudWatch Logs

CloudTrail

ELB

RDS

Redshift

S3

DynamoDB

EBS

Elasticsearch

SageMaker

ACM

API Gateway

CloudFront

Config

DAX

EFS

KMS

SNS

VPC

WAFv2