ctfkit
ctfkit by compliance.tf runs the same Terraform and OpenTofu checks in every pipeline you have and writes one findings format that your existing policy stack reads. When a compliance.tf module would close a gap, the finding names that module. This page is for platform leads and security engineers deciding whether to adopt it; it ends with how to install it.
The problem
A platform team that owns Terraform standards rarely owns one pipeline. Each pipeline grows its own checks, so the same change can pass in GitHub Actions and fail in Spacelift. The gaps that matter most, such as a raw resource where a hardened module exists, often surface only in an audit sample or in production, when fixing them means migrating live resources.
With ctfkit:
- The same binary and settings file run the same checks in a pre-commit hook, GitHub Actions, Spacelift or a shell.
- Findings come out as SARIF for code scanning, JSON for OPA or your own scripts, and Spacelift metadata for a plan policy. ctfkit runs alongside Sentinel, and the policy tool you already use decides what blocks a merge.
- A finding that a compliance.tf module would close carries the module source, for example
soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws. scan,report,verify-lockandconfigrun offline: they open no network connection, read no credentials and never runterraformortofu. The catalog compiled into the binary holds the CIS AWS Benchmark v6.0 controls. The full control catalog, with every control and framework, is a separate file thatctfkit catalog pulldownloads with your compliance.tf registry token on a paid plan.
Who it helps
| Who | What they get |
|---|---|
| Platform leads who own Terraform and OpenTofu standards | one set of checks that runs unchanged in every pipeline, rolled out repository by repository or stack by stack |
| Security and compliance teams | a findings record in a standard format, with the rule, the resource, the file and line, and the control when there is one, and a clear statement of what each check does and does not prove. You can review it and store it with your other CI evidence. Findings and receipts are not signed; receipt signing is planned |
| Module authors and developers | fast pre_plan feedback in the pull request and the pre-commit hook, before init and with no credentials |
Where it runs
Commands describes the three stages ctfkit checks at.
- GitHub Actions: a public action that comments on the pull request, writes the job summary and uploads SARIF.
- Spacelift: two stack hooks and one plan policy, warn first, then deny per stack.
- Pre-commit and any shell: the same binary. The Quickstart runs both scans by hand, and the pre-commit hook setup is in the Pre-commit section of the ctfkit README.
Status
Every capability carries a label. Available means it ships in the current release and is supported. Not available means the command ships but cannot be used: it needs a signed organization profile and floor statement (--org, --profile, --floor), and compliance.tf does not issue them. Planned means there is no code behind it today.
| Capability | Status | Since ctfkit |
|---|---|---|
scan: credential-free analysis of a configuration (pre_plan) or its plan JSON (post_plan) | available | v0.1.0 |
| SARIF, JSON, text, pretty, JUnit and Spacelift metadata output | available | v0.1.0 |
pre-commit hook ctfkit | available | v0.1.0 |
pre-commit hook ctfkit-scan-dir, for module repositories | available | v0.3.0 |
| Resource-type, provider and tag allowlists | available | v0.1.0 |
OPA example: a Rego policy that decides on scan -f json output | available | v0.2.0 |
report: reads the module cache after init and writes README markdown, an evidence receipt, SARIF and Spacelift metadata; reports code that runs before plan in modules at any depth | available | v0.2.0 |
| Analyzer SDK and conformance harness | available | v0.2.0 |
| GitHub Action and Spacelift adapters | available | v0.2.0 |
verify-lock: lock files install the compliance.tf provider wrappers, not the upstream providers | available | v0.3.0 |
Governed apply: gate plan, gate sign, verdict verify, apply | not available | v0.3.0 |
| Spacelift governed apply | not available | v0.3.0 |
| env0 custom flow (governed apply on env0) | not available | v0.3.0 |
evidence ship: provider evidence chains to S3 Object Lock and the provider-run receipt | not available | v0.3.0 |
runtask serve: an advisory HCP Terraform and Terraform Enterprise run task | not available | v0.3.0 |
Container images (ghcr.io/compliancetf/ctfkit), SBOMs and build provenance attestations for release files | available | v0.3.0 |
Homebrew formula compliancetf/tap/ctfkit, for macOS and Linux | available | v0.3.0 |
| Windows arm64 archive | available | v0.4.0 |
| Embedded catalog of the CIS AWS Benchmark v6.0 controls; every other control and framework comes from the full catalog file | available | v0.5.0 |
catalog pull: downloads the full control catalog from the compliance.tf registry (paid plan) | available | v0.6.0 |
GitHub Action input catalog: pull | available | v0.7.0 |
| Receipt signing | planned |
This documentation describes the newest ctfkit release. Findings, SARIF, JSON and receipts are not signed. Compliance.tf does not sign, attest or verify anything for you. Receipt signing is planned.
What it is not
- It produces findings and an exit code. It does not decide what your pipeline blocks; OPA, Sentinel or a Spacelift policy does.
- It runs next to the scanner you already use and reports what your configuration requires and which compliance.tf module closes each gap.
- Its analyzers never read your cloud accounts or live state.
- Its checks,
scan,reportandverify-lock, never runterraformortofu. The governed apply commands do, because they own the plan and apply steps.
Get ctfkit
ctfkit is Apache-2.0 software in the public repository compliancetf/ctfkit. Each release on GitHub Releases carries archives for Linux, macOS and Windows, .deb, .rpm and .apk packages, checksums.txt, an SPDX SBOM per archive and a build provenance attestation. On macOS and Linux, brew install compliancetf/tap/ctfkit installs the newest release. A download needs no account and no token. Container images are at ghcr.io/compliancetf/ctfkit.
- Follow the Quickstart to install a release and run your first two scans.
- Bug reports, feature requests and questions about a rule go in an issue. Only maintainers submit pull requests.
- Report a vulnerability privately, as SECURITY.md describes, not in an issue.
Your pipeline still needs its usual credentials for the steps ctfkit reads from: a compliance.tf registry token for init, and cloud credentials for plan. catalog pull uses the network and the same compliance.tf token, set as TF_TOKEN_registry_compliance_tf for the registry.compliance.tf host, to download the full catalog; scan and report stay offline. Commands that are not available differ: the governed apply commands, gate plan, gate sign, verdict verify and apply, run terraform, and gate sign, evidence ship and runtask serve call AWS KMS, S3 or HCP Terraform. Network and credentials lists each one.
Pages in this section
- Quickstart: install a release and run your first two scans.
- Commands: stages,
scan,report,verify-lock,catalog pull, the governed apply, evidence and run task commands, flags, exit codes and settings. - GitHub Actions: the action, tokens, permissions and a complete workflow.
- Spacelift: runner image, stack hooks and the plan policy.
- Reference analyzers: every rule ID, its stage and its limits.