awesome-terraform-compliance

Side-by-side comparison of Terraform security scanning tools with feature matrices.

Curated cloud security newsletter covering IaC security, CSPM, and compliance tools.

Patterns for managing secrets in Terraform without exposing sensitive values in state files, covering AWS Secrets Manager and compliant credential handling.

Official tutorials for writing Sentinel policies in Terraform Cloud/Enterprise.

Kief Morris' guide to managing infrastructure with automation covering compliance and governance patterns.

Practical implementation of ISO 27001 controls on AWS infrastructure provisioned with Terraform, with control-to-resource mappings.

Self-hosted Terraform pull request automation with pre-apply policy check hooks.

JetBrains IDE plugin (IntelliJ, PyCharm, etc.) for IaC security scanning including Terraform, enabling shift-left detection in the editor.

Extensible repository linter with HCL-defined rules and a plan/apply workflow, used by Azure Verified Modules to enforce license, file-structure, and content standards across Terraform module repos.

Collection of Git pre-commit hooks for Terraform including linting, validation, and security scanning.

Integration point for adding compliance checks to Terraform Cloud/Enterprise runs.

GitHub Action that analyses Terraform plan JSON and comments risk levels on pull requests.

Runs Atlantis-driven

Open-source tool that surfaces infrastructure drift, security findings, and cost estimates as pull requests against your Terraform codebase.

SDK and CLI for creating and validating OSCAL documents, part of the OSCAL Compass project.

Open-source Terraform CI/CD with drift detection capabilities.

Compliance automation platform with infrastructure evidence collection including Terraform state integration. 💲

Receives Terraform drift reports via API and provides a web dashboard with historical tracking, analytics, and Slack notifications.

Cloud security resources across AWS, Azure, and GCP.

DevSecOps tools and resources including IaC security.

Open Policy Agent tools, frameworks, and articles.

OSCAL ecosystem tools and resources.

Curated Terraform and OpenTofu resources.

Managed and custom rules evaluating AWS resource configurations against compliance baselines, deployable via Terraform.

Managed landing zone service with SCPs and Config rules as guardrails for multi-account AWS environments, configurable via Terraform.

Official AWS sample showing how to implement and administer preventive, detective, and proactive Control Tower guardrails via Terraform IaC.

Aggregated security and compliance findings across AWS accounts with CIS, PCI DSS, and NIST benchmarks.

Preventive governance policies at the AWS Organizations level, deployable via Terraform to enforce compliance boundaries across all accounts.

Policy enforcement service for Azure resources with built-in compliance definitions deployable via Terraform.

Official AWS registry of Guard rules covering CIS, NIST, PCI DSS, HIPAA, and SOC 2 compliance frameworks, applicable to Terraform plan JSON via cfn-guard.

Utility for writing tests against structured configuration data using OPA/Rego, widely used for Terraform plan validation.

Rego policy library with a dedicated

Linter for Rego policies with 50+ built-in rules covering correctness, style, and performance. Catches bugs and anti-patterns before policies reach production.

Example Sentinel policies for Terraform Cloud/Enterprise demonstrating common compliance patterns.

TFLint plugin for writing custom compliance rules in Rego, bridging tflint's Terraform-native linting with OPA policy evaluation.

Cloud Adoption Framework landing zone modules with built-in governance and compliance patterns.

Compliance-ready Terraform modules wrapping terraform-aws-modules with enforced compliance controls and audit evidence generation for SOC 2, HIPAA, PCI DSS, NIS2, DORA, and ISO 27001. 💲 🆓

Google-maintained Terraform modules and blueprints for incrementally hardening brownfield GCP environments, with custom IAM role generation and organization policy constraints.

Google-maintained Terraform blueprints for secure GCP deployments with organizational policy compliance.

Compliance automation platform providing Terraform modules for AWS infrastructure meeting HIPAA, PCI DSS, FedRAMP, StateRamp, and CMMC requirements. 💲

Protected B/Medium/Medium GCP landing zone with Canadian government compliance patterns. 🏛️

Static analysis tool with 1,000+ built-in policies covering CIS, SOC 2, HIPAA, PCI DSS, and NIST benchmarks for Terraform, CloudFormation, Kubernetes, and more.

Policy-as-code DSL from AWS for writing rules that validate JSON and YAML data, including Terraform plan JSON and HCL configurations.

High-performance open-source scanner combining SAST, SCA, secret detection, and IaC analysis for Terraform and other formats, built for CI/CD pipelines.

Open-source scanner by Checkmarx with 1,900+ queries across Terraform, Ansible, Docker, and Kubernetes.

Scans Terraform and OpenTofu code to calculate the minimum IAM permissions required for deployment across AWS, GCP, and Azure.

NCC Group's tool for spinning up intentionally misconfigured AWS infrastructure via Terraform to test detection coverage.