compliance.tf

What It Is

Compliance.tf is a compliance module registry for Terraform-based AWS infrastructure. Built on terraform-aws-modules, it provides drop-in replacements: by changing a module’s source to the compliance.tf registry endpoint, controls for frameworks such as SOC 2, PCI DSS, HIPAA, CIS, NIST, FedRAMP, ISO 27001, and GDPR are built directly into the module code. The core idea is not “scan after deployment,” but to prevent non-compliant configurations from reaching production before terraform plan/apply.

Core Capabilities

For engineering teams, the biggest selling point is the low migration cost: the same variables, outputs, and workflows are preserved, and in most cases you only need to change one source line and run terraform init. It currently covers 34 AWS modules, including S3, VPC, EKS, RDS, and Lambda, with 300+ controls across 35+/36 frameworks. It also supports Operational Rules, such as lifecycle blocks, tagging standards, instance restrictions, and provisioner removal. For CI/CD, if your pipeline can run terraform init, it can be used with GitHub Actions, GitLab CI, Atlantis, and Terraform Cloud; it is also compatible with OpenTofu, Terragrunt, and Terramate.

Pricing and Support

The free tier permanently includes CIS AWS Foundations Benchmark v6.0, 27 controls, 5 members, and 100 downloads per month, plus a 30-day trial of all frameworks. Full Access costs $1,000/year and includes all frameworks, 25 members, unlimited downloads, and email support; it can be purchased via AWS Marketplace. The Enterprise plan offers BYOM, custom frameworks/controls, SSO/SAML, and priority support, but requires contacting sales.

Pros and Cons

The main advantage is that compliance is shifted left to the module layer, reducing audit findings and late-stage remediation work. It does not require a new CLI, policy agent, or sidecar, and it can generate audit evidence through AWS Config, Security Hub, and Audit Manager. The limitations are also clear: it only covers modules in its catalog and the infrastructure configuration layer, and does not address IAM policies, network architecture, application security, runtime drift, incident response, or similar areas. Non-Terraform resources and native aws_* resources still need to be covered by tools such as Checkov, Trivy, Prowler, or Wiz. It is also a paid SaaS/private registry, which introduces an external dependency.

Who It’s For and Access from China

It is best suited to platform, security, and GRC teams that have already standardized on terraform-aws-modules and are preparing for audits such as SOC 2, PCI, or HIPAA. It is less suitable for teams running multi-cloud environments or many in-house modules, especially if they do not want to rely on an external registry. The available materials do not specify access from China, so network availability and payment support are unknown. Alternatives or complementary options include Checkov, Trivy, Prowler, OPA/Sentinel, AWS Control Tower, and GRC platforms such as Vanta, Drata, and Sprinto.