CIS AWS controls built into your Terraform modules. Enforced before apply.
Level 1 and Level 2 Benchmark recommendations for AWS: identity, storage, logging and networking. The modules enforce these controls before apply and list the Benchmark section each one maps to, where the catalog names one.
Modules enforce 17 of 28 CIS AWS controls in the catalog. Of the 18 that cite a CIS AWS clause, they enforce 11. The controls they do not enforce stay with your team, with monitoring, alerting, access reviews and penetration testing.
No credit card or AWS account needed to start. By Anton Babenko, maintainer of terraform-aws-modules, more than 2 billion provisions.
Annex J: CIS AWS
- Framework
- CIS AWS Foundations Benchmark v6.0.0
- For
- Your team, on Terraform
Scope for CIS AWS
The CIS Benchmark is a prescriptive baseline when no industry mandate applies. Many teams start here and map up to SOC 2 or NIST when audits come.
Covers
- Infrastructure controls on AWS resources that map to CIS AWS Foundations Benchmark v6.0.0 sections, by section in J.3.
- terraform-aws-modules through the CIS AWS framework host or your org endpoint. Once your team switches to the compliance.tf provider, resources written by hand outside modules are checked against its built-in CIS controls, not the CIS AWS set.
Stays with your team
- Network monitoring and VPC flow log analysis.
- Malware defense and endpoint protection.
- Data recovery testing and validation.
- Security awareness and skills training.
- Audit log monitoring and alerting.
- Account and identity management policies.
- Penetration testing and vulnerability assessments.
- Resources outside compliance.tf module coverage, and every control J.4 lists as Mapped: 7 with a CIS AWS clause and 4 without one.
The source line
Point a module at the CIS AWS framework host. Same inputs and outputs, no state migration. Terraform 1.0 or later.
- source = "terraform-aws-modules/s3-bucket/aws" + source = "cis.compliance.tf/terraform-aws-modules/s3-bucket/aws" version = "~> 5.0"
With an org endpoint, the source names your org host instead, and CIS AWS comes from your org's configuration.
Enforced and mapped, by section
Of the 18 CIS AWS controls in the documented catalog that cite a clause, modules enforce 11. A control appears once under each section it maps to.
The catalog maps 10 more controls to CIS AWS without naming a clause, 6 of them enforced. They are listed apart at the end of J.4 and left out of these counts.
Every row is a control your auditor can look up.
Filter the register, or search by control name or clause, for example 3.2.
18 of 18 shown
Each control links to its public docs page.
- Enforced
- Modules set this control before anything is deployed.
- Mapped
- Documented on its docs page, not set by modules. Your team owns it.
Control register
Enforced or mapped without a named CIS AWS clause
The catalog lists these 10 controls under CIS AWS but names no CIS AWS clause for them, so the register and the counts in J.3 leave them out. Each still links to its docs page.
Clause IDs for the auditor. Your stack stays as it is.
Compliance.tf works alongside your scanners, plan policy, CSPM and GRC tool. It sets the controls in the modules and lists the clause each one is there for.
Evidence
What compliance.tf gives your auditor
- The CIS AWS clause IDs behind each enforced setting, with stable control IDs and public docs pages.
- The config snapshot bound to each environment, and the per-action audit log of promotions between environments.
What comes from your AWS account and GRC tool
Evidence of what actually runs comes from your own account, for example AWS Config and your CSPM. Your GRC tool keeps tracking policies and audit workflows.
Related reading
Make Non-Compliant Terraform Impossible, Verifying Compliance.tf Modules, the comparisons with other tools, and the CIS AWS framework registry at cis.compliance.tf.
Plans for CIS AWS
CIS AWS is in the 30-day trial and in Full Access, $1,000 a year on AWS Marketplace, with every other framework in the catalog. Schedule of fees.
Questions about CIS AWS
Which CIS Benchmark version is supported?
Compliance.tf maps controls to CIS AWS Benchmark v6.0.0, the latest version, and the module registry subdomain cis.compliance.tf serves those mappings. CIS AWS v1.2.0, v1.3.0 and v1.4.0 are retired. Their registry hostnames, such as cisv140.compliance.tf, now serve the v6.0.0 mappings too.
What changed for teams on CIS AWS v1.4.0?
On November 7, 2026, compliance.tf retired CIS AWS v1.2.0, v1.3.0 and v1.4.0, and their registry hostnames started serving CIS v6.0.0. Against v1.4.0, 15 controls drop out, among them S3 bucket logging, versioning and default encryption, CloudTrail to CloudWatch Logs integration, unused IAM policies and credentials, and RDS encryption in transit. 16 controls come in, among them EBS encryption by default, EC2 IMDSv2, EFS encryption at rest, RDS Multi-AZ, public access and minor version upgrades, Security Hub, Macie for S3, and IPv6 remote administration ingress.
Does this cover Level 1 and Level 2?
Yes, compliance.tf enforces Level 1 (essential security) and Level 2 (defense-in-depth) recommendations that map to resource configuration. Some Level 2 recommendations are operational (monitoring review processes, log analysis) and remain your team's responsibility.
Can I adopt this gradually, or is it all-or-nothing?
Fully incremental. Start with one module in one environment. Your existing modules continue working untouched. If you use Terragrunt or Terramate to orchestrate your runs, nothing changes - you're only swapping the module source line. There is no global policy agent to deploy, no wrapper binary, no sidecar. Each module source line is independent.
What if we want to switch back?
Each module keeps the inputs and outputs of its terraform-aws-modules counterpart and needs no state migration, so switching back is the same source line change in reverse.