SOC 2 Compliant Terraform Modules
Enforced Before terraform apply
Your SOC 2 audit needs encryption, logging, access controls, and versioning on every AWS resource. These modules enforce all of it before terraform apply.
If you sell software or cloud services to other businesses, your customers will ask for a SOC 2 report. Procurement teams at enterprise buyers treat it as a gate — no report, no signed contract.
130
Controls
13
Clauses
34
AWS Modules
No credit card or AWS account needed to start.
From the team behind terraform-aws-modules. 2B+ provisions worldwide.
Three Steps to SOC 2 Compliant Infrastructure
For terraform-aws-modules users, migration is a one-line change. Same workflow, same interface. Bringing your own modules? We can make those compliant too. Join the beta.
Change One Line
Run Terraform Commands
Compliance Enforced
Every compliance requirement you define is enforced automatically. Nothing to scan, nothing to remediate.
Controls Enforced for SOC 2
130 controls across 13 clauses and AWS services
Additional Controls
125 additional controls enforced for SOC 2
SOC 2 Scope: What We Handle vs. What You Own
compliance.tf handles the infrastructure configuration layer for SOC 2. Here is what it covers and what stays with your team.
compliance.tf Enforces for SOC 2
- Module-level infrastructure controls (encryption, logging, access, versioning)
- Trust Services Criteria mapping (CC6.1, CC6.6, CC7.2, and more)
- Deployment-time evidence generation via AWS-native tools
- Upstream module updates (terraform-aws-modules kept in sync)
- Exception management with audit trail
- Control documentation and compliance mapping matrices
Your Team Still Handles for SOC 2
- Organizational policies and procedures
- Employee background checks and security training
- Change management procedures and approval workflows
- Vendor management and third-party risk assessments
- Incident response and communication plans
- Business continuity and disaster recovery testing
- Resources outside compliance.tf module coverage
Infrastructure controls are typically 30-40% of SOC 2 audit findings. compliance.tf handles that portion so your team can focus on organizational controls.
SOC 2 Audit Evidence, Generated Automatically
Your auditor does not need to trust compliance.tf. Evidence comes from AWS-native tools they already accept.
Evidence your auditor already trusts
Every compliance.tf module enforces controls at deploy time. When AWS Config, Security Hub, or Audit Manager evaluates your resources, they report clean findings because the controls are built into the modules, not bolted on after the fact.
- AWS Config rules validate resource configuration continuously
- Security Hub aggregates findings across accounts and regions
- Audit Manager generates assessment reports mapped to SOC 2
- Downloadable control mapping matrices for your auditor
Prevention vs. Detection for SOC 2
compliance.tf prevents non-compliant deployments. Scanning tools detect them after the fact. Most mature programs use both.
| Dimension | IaC Scanning Checkov / Trivy / Prowler | compliance.tf |
|---|---|---|
| Prevents non-compliant configs before terraform apply | No (post-plan scan) | Yes |
| Maps controls to framework clause IDs | Partial | Yes |
| Produces auditor-accepted evidence (AWS-native) | Scan reports only | Yes |
| Exception management with audit trail | Suppression rules | Yes |
| Same interface as terraform-aws-modules | N/A | Yes |
| Keeps pace with upstream module updates | N/A | Yes |
| Catches runtime drift / console changes | Yes | No |
| Covers non-Terraform resources | Yes | No |
| Internal engineering time | Medium | Low |
We recommend keeping scanning tools active alongside compliance.tf for defense in depth. The scanner validates what compliance.tf already enforces.
SOC 2 Compliance Questions
Which Trust Services Criteria does this cover?
How is this different from Checkov, Trivy, or Prowler?
Can I adopt this gradually, or is it all-or-nothing?
Does compliance.tf replace our GRC platform (Vanta, Drata, Sprinto)?
Will my auditor accept this as evidence?
What if I want to switch back or compliance.tf shuts down?
Start Deploying SOC 2-Compliant Infrastructure
$100/year for all 34 modules, all frameworks. 30-day free trial.
No credit card required. Switch back at any time.
Stay Informed About New Features
Join the mailing list for releases, new modules, and roadmap updates. No spam. Unsubscribe anytime.
Not convinced yet or dying for a feature we don't have? Send us an email — we really want to hear your feedback!