SOC 2 controls built into your Terraform modules. Enforced before apply.
Your SOC 2 audit asks for encryption, logging, access controls and versioning on AWS resources. The modules enforce these controls before apply and list the Trust Services Criteria clause each one maps to, where the catalog names one.
Modules enforce 94 of 140 SOC 2 controls in the catalog. Of the 121 that cite a SOC 2 clause, they enforce 80. The controls they do not enforce stay with your team, with policies, training, vendor reviews and incident response.
No credit card or AWS account needed to start. By Anton Babenko, maintainer of terraform-aws-modules, more than 2 billion provisions.
Annex A: SOC 2
- Framework
- SOC 2, Trust Services Criteria
- For
- Your team, on Terraform
Scope for SOC 2
If you sell software or cloud services to other businesses, their procurement teams ask for a SOC 2 report, often before they sign.
Covers
- Infrastructure controls on AWS resources that map to Trust Services Criteria clauses, by clause family in A.3.
- terraform-aws-modules through the SOC 2 framework host or your org endpoint, and resources written by hand outside modules once your team switches to the compliance.tf provider.
Stays with your team
- Organizational policies and procedures.
- Employee background checks and security training.
- Change management procedures and approval workflows.
- Vendor management and third-party risk assessments.
- Incident response and communication plans.
- Business continuity and disaster recovery testing.
- Resources outside compliance.tf module coverage, and every control A.4 lists as Mapped: 41 with a SOC 2 clause and 5 without one.
The source line
Point a module at the SOC 2 framework host. Same inputs and outputs, no state migration. Terraform 1.0 or later.
- source = "terraform-aws-modules/s3-bucket/aws" + source = "soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws" version = "~> 5.0"
With an org endpoint, the source names your org host instead, and SOC 2comes from your org's configuration.
Enforced and mapped, by clause family
Of the 121 SOC 2 controls in the documented catalog that cite a clause, modules enforce 80. A control appears once under each clause family it maps to.
The catalog maps 19 more controls to SOC 2 without naming a clause, 14 of them enforced. They are listed apart at the end of A.4 and left out of these counts.
Every row is a control your auditor can look up.
Filter the register, or search by control name or clause, for example CC6.1.
121 of 121 shown
Each control links to its public docs page.
- Enforced
- Modules set this control before anything is deployed.
- Mapped
- Documented on its docs page, not set by modules. Your team owns it.
Control register
Supporting: the control is partial or indirect evidence for the clause, not full enforcement.
Enforced or mapped without a named SOC 2 clause
The catalog lists these 19 controls under SOC 2 but names no SOC 2 clause for them, so the register and the counts in A.3 leave them out. Each still links to its docs page.
Clause IDs for the auditor. Your stack stays as it is.
Compliance.tf works alongside your scanners, plan policy, CSPM and GRC tool. It sets the controls in the modules and lists the clause each one is there for.
Evidence
What compliance.tf gives your auditor
- The SOC 2 clause IDs behind each enforced setting, with stable control IDs and public docs pages.
- The config snapshot bound to each environment, and the per-action audit log of promotions between environments.
What comes from your AWS account and GRC tool
Evidence of what actually runs comes from your own account, for example AWS Config and your CSPM. Your GRC tool keeps tracking policies and audit workflows.
Related reading
Make Non-Compliant Terraform Impossible, Verifying Compliance.tf Modules, Why Enterprises Choose Compliance.tf, the comparisons with other tools, and the SOC 2 framework registry at soc2.compliance.tf.
Plans for SOC 2
SOC 2 is in the 30-day trial and in Full Access, $1,000 a year on AWS Marketplace. Schedule of fees.
Questions about SOC 2
Which Trust Services Criteria does this cover?
Compliance.tf enforces infrastructure controls mapped to Trust Services Criteria, for example CC6 (Logical and Physical Access Controls), CC7 (System Operations) and CC8 (Change Management). These are the criteria tied to AWS resource configuration: encryption at rest and in transit, access blocking, logging, versioning, and lifecycle policies. The control register lists every criteria family with the controls modules enforce and the ones left to you.
Can I adopt this gradually, or is it all-or-nothing?
Fully incremental. Start with one module in one environment. Your existing modules continue working untouched. If you use Terragrunt or Terramate to orchestrate your runs, nothing changes - you're only swapping the module source line. There is no global policy agent to deploy, no wrapper binary, no sidecar. Each module source line is independent.
What if we want to switch back?
Each module keeps the inputs and outputs of its terraform-aws-modules counterpart and needs no state migration, so switching back is the same source line change in reverse.