Annex E: GDPR

GDPR controls built into your Terraform modules. Enforced before apply.

Article 32 asks for technical measures that protect personal data: encryption at rest and in transit, access controls and audit logging. The modules enforce these controls before apply and list the GDPR article each one maps to, where the catalog names one.

Modules enforce 30 of 50 GDPR controls in the catalog. Of the 39 that cite a GDPR clause, they enforce 22. The controls they do not enforce stay with your team, with consent, DPIAs, data subject requests and breach notification.

Start free trial View all controls

No credit card or AWS account needed to start. By Anton Babenko, maintainer of terraform-aws-modules, more than 2 billion provisions.

Annex E: GDPR

Framework: GDPR (EU 2016/679)
For: Your team, on Terraform

E.1

Scope for GDPR

GDPR applies when you process personal data of people in the EU, wherever your company is based. A US product with European users is in scope.

E.1.1

Covers

Infrastructure controls on AWS resources that map to GDPR articles, by article in E.3.
terraform-aws-modules through the GDPR framework host or your org endpoint, and resources written by hand outside modules once your team switches to the compliance.tf provider.

E.1.2

Stays with your team

Data Protection Officer appointment.
Data Protection Impact Assessments.
Consent management and the legal basis for processing.
Data subject requests: access, rectification and erasure (Art. 15 to 22).
Breach notification to supervisory authorities (Art. 33 and 34).
Data processing agreements (Art. 28).
Privacy policies and the organizational records of processing (Art. 30).
Resources outside compliance.tf module coverage, and every control E.4 lists as Mapped: 17 with a GDPR clause and 3 without one.

E.2

The source line

Point a module at the GDPR framework host. Same inputs and outputs, no state migration. Terraform 1.0 or later.

-  source  = "terraform-aws-modules/s3-bucket/aws"
+  source  = "gdpr.compliance.tf/terraform-aws-modules/s3-bucket/aws"
   version = "~> 5.0"

With an org endpoint, the source names your org host instead, and GDPRcomes from your org's configuration.

E.3

Enforced and mapped, by article

Of the 39 GDPR controls in the documented catalog that cite a clause, modules enforce 22. A control appears once under each article it maps to.

Art. 3220 of 28

Art. 251 of 12

Art. 303 of 5

The catalog maps 11 more controls to GDPR without naming a clause, 8 of them enforced. They are listed apart at the end of E.4 and left out of these counts.

Every row is a control your auditor can look up.

Filter the register, or search by control name or clause, for example Art. 32.

Search controls

39 of 39 shown

Each control links to its public docs page.

Enforced: Modules set this control before anything is deployed.
Mapped: Documented on its docs page, not set by modules. Your team owns it.

E.4

Control register

Control	Status	GDPR clauses
CloudFront distributions should require encryption in transit	Enforced	Art. 32
DynamoDB tables should have AWS KMS encryption enabled	Enforced	Art. 32
DynamoDB tables should have encryption enabled	Enforced	Art. 32
Attached EBS volumes should have encryption enabled	Enforced	Art. 32
EFS file systems should have encryption at rest enabled	Enforced	Art. 32
ELB application and classic load balancer logging should be enabled	Enforced	Art. 30
ELB application load balancers should drop invalid HTTP headers	Enforced	Art. 32
KMS CMK rotation should be enabled	Enforced	Art. 25, Art. 30
Log groups should have encryption at rest enabled	Enforced	Art. 32
OpenSearch domains should have encryption at rest enabled	Enforced	Art. 32
OpenSearch domains node-to-node encryption should be enabled	Enforced	Art. 32
RDS DB instance backup should be enabled	Enforced	Art. 32
RDS DB instances should be integrated with CloudWatch logs	Enforced	Art. 32
RDS DB instance encryption at rest should be enabled	Enforced	Art. 32
RDS DB instances should have logging enabled	Enforced	Art. 32
Redshift clusters should have audit logging enabled	Enforced	Art. 30, Art. 32
Redshift clusters should have automatic snapshots enabled	Enforced	Art. 32
Redshift cluster encryption in transit should be enabled	Enforced	Art. 32
Redshift clusters should have audit logging and encryption enabled	Enforced	Art. 32
S3 buckets should have default encryption enabled	Enforced	Art. 32
S3 buckets should have default encryption enabled using KMS	Enforced	Art. 32
SNS topics should be encrypted at rest	Enforced	Art. 32
API Gateway stages should have cache encryption at rest enabled	Mapped	Art. 32
CloudTrail trails should be integrated with CloudWatch logs	Mapped	Art. 25, Art. 30
CloudTrail trails should have logs encrypted using a customer managed KMS key	Mapped	Art. 25, Art. 30, Art. 32
CloudTrail trails should have log file validation enabled	Mapped	Art. 25, Art. 32
DynamoDB Accelerator (DAX) clusters should be encrypted at rest	Mapped	Art. 32
ES domain encryption at rest should be enabled	Mapped	Art. 32
Elasticsearch domain node-to-node encryption should be enabled	Mapped	Art. 32
IAM password policies should have minimum length set to 14 or greater	Mapped	Art. 25
IAM password policies should require at least one lowercase letter	Mapped	Art. 25
IAM password policies should require at least one number	Mapped	Art. 25
IAM password policies should require at least one symbol	Mapped	Art. 25
IAM password policies should require at least one uppercase letter	Mapped	Art. 25
IAM password policies should prevent password reuse	Mapped	Art. 25
IAM password policies should have strong configurations	Mapped	Art. 25
IAM password policies should expire passwords within 90 days or less	Mapped	Art. 25
SageMaker endpoint configuration encryption should be enabled	Mapped	Art. 32
SageMaker notebook instance encryption should be enabled	Mapped	Art. 32

Enforced or mapped without a named GDPR clause

The catalog lists these 11 controls under GDPR but names no GDPR clause for them, so the register and the counts in E.3 leave them out. Each still links to its docs page.

Control	Status
EFS file systems should be encrypted with CMK	Enforced
ELB application load balancers should be configured to drop HTTP headers	Enforced
ELB application and network load balancer listeners should use secure protocols	Enforced
RDS DB instances backup retention period should be greater than or equal to 7	Enforced
RDS for MariaDB DB instances should publish logs to CloudWatch Logs	Enforced
RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs	Enforced
RDS for SQL Server DB instances should publish logs to CloudWatch Logs	Enforced
Redshift clusters should have required maintenance settings	Enforced
CloudTrail trails should have at least one enabled trail present in a region	Mapped
IAM password policies should have strong configurations with minimum length of 8 or greater	Mapped
S3 buckets should have object logging enabled	Mapped

Clause IDs for the auditor. Your stack stays as it is.

Compliance.tf works alongside your scanners, plan policy, CSPM and GRC tool. It sets the controls in the modules and lists the clause each one is there for.

Start free trial See plans

E.5

Evidence

E.5.1

What compliance.tf gives your auditor

The GDPR clause IDs behind each enforced setting, with stable control IDs and public docs pages.
The config snapshot bound to each environment, and the per-action audit log of promotions between environments.

E.5.2

What comes from your AWS account and GRC tool

Evidence of what actually runs comes from your own account, for example AWS Config and your CSPM. Your GRC tool keeps tracking policies and audit workflows.

E.5.3

Plans for GDPR

GDPR is in the 30-day trial and in Full Access, $1,000 a year on AWS Marketplace. Schedule of fees.

E.7

Questions about GDPR

E.7.1

Does this make me GDPR compliant?

No. GDPR compliance requires organizational measures that no infrastructure tool can handle: appointing a DPO, conducting DPIAs, managing consent, responding to data subject requests, and notifying authorities of breaches within 72 hours. Compliance.tf handles the Article 32 technical measures layer. You still need the rest.

E.7.2

We're a US company. Do we need GDPR modules?

If you process personal data of people in the EU, yes. GDPR applies based on whose data you handle, not where your company is located. A US SaaS product with European users is in scope.

E.7.3

Can I adopt this gradually, or is it all-or-nothing?

Fully incremental. Start with one module in one environment. Your existing modules continue working untouched. If you use Terragrunt or Terramate to orchestrate your runs, nothing changes - you're only swapping the module source line. There is no global policy agent to deploy, no wrapper binary, no sidecar. Each module source line is independent.

E.7.4

What if we want to switch back?

Each module keeps the inputs and outputs of its terraform-aws-modules counterpart and needs no state migration, so switching back is the same source line change in reverse.