Compliance.tf - Terraform Control Layer for AWS

Compliance.tf is the Terraform control layer for AWS. It serves Terraform modules for AWS from a private registry with your compliance controls and org rules applied: the 51 maintained terraform-aws-modules, any public registry module, and your own modules from a private source. Compliance.tf makes a Terraform estate provable: the controls are built into the modules, held before apply, and mapped to the clauses your auditor asks about.

To adopt, change the module source line, for a maintained module or any other public AWS module, from the public registry to a framework endpoint, such as soc2.compliance.tf, pcidssv40.compliance.tf or hipaa.compliance.tf, or to your org endpoint. Inputs and outputs stay the same and there is no state migration. It works with Terraform 1.0 or later and OpenTofu 1.6 or later. Move one module at a time: the modules produce standard Terraform state, so you can switch back to the upstream source at any time.

Controls are applied in the module when Terraform downloads it at init, so they hold before apply: encryption at rest, public access blocks, IMDSv2, logging and monitoring, data lifecycle and network security. Developers cannot turn an enforced setting off through module inputs. Org rules add your own standards on top, such as allowed regions, prevent-destroy on data resources and allowed instance types.

Each enforced control is mapped to the framework clauses it covers, for SOC 2, PCI DSS, HIPAA, NIST 800-53, ISO 27001, NIS2, FedRAMP Moderate (Rev 4) and CIS. The docs list every framework and its controls at compliance.tf/docs/frameworks . Your org gets one baseline and named rulesets for every module it pulls, promotion gates between environments with an audit trail of every action, and a registry UI that shows each module's variables, outputs and enforced controls. A SOC 2 Type II report covering compliance.tf is available for your vendor review.

Your own modules, on the Enterprise plan: point compliance.tf at the private source where your team keeps its modules and they come back with the same controls applied. Preview, on request: ctfkit by compliance.tf checks your Terraform in CI against the same controls, on GitHub Actions and Spacelift, and names the compliance.tf module that closes each gap.

Compliance.tf works alongside Checkov, OPA, Wiz, Vanta and Drata and replaces none of them. OPA decides whether a plan passes. Compliance.tf decides what goes into the plan, and records why. Compliance.tf proves the governed path; your CSPM proves the deployed estate. Modules for AWS: the maintained terraform-aws-modules, any public registry module and your own. Control and framework references for AWS, Azure and Google Cloud. Azure and Google Cloud modules planned.