Registry endpoints
For an engineer writing the source line of a module block. This page lists the two source formats, the host for each framework, how each format authenticates, and the errors you can get back.
- Each framework has its own host, such as
soc2.compliance.tf. The host decides which framework's controls the module is built with. registry.compliance.tfserves the modules with no controls, as a base to add controls to.- Your organization's own host,
<alias>.compliance.tf, serves your organization's posture and refuses posture overrides. - Both formats need a registry token. There is no anonymous download.
Which one to use
| Your situation | Format | Why |
|---|---|---|
| Starting out, or no controls to turn off | Terraform Registry format | Native version constraints such as ~> 5.0; authenticates with terraform login or TF_TOKEN_* |
| Turning individual controls on or off | HTTPS URL format | The only form that accepts ?enable= and ?disable= |
| HCP Terraform or Terraform Enterprise | Terraform Registry format | Uses the workspace's registry credentials; no .netrc on the runner |
| Spacelift, env0 or Atlantis | Either | Store the token as your platform documents; see CI/CD integration |
You can switch a module between the formats later. Its inputs and state do not change.
Syntax
Terraform Registry format
module "..." {
source = "<framework>.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}Terraform authenticates this format from the CLI configuration. On your own machine, terraform login soc2.compliance.tf stores a short-lived token. In a pipeline, set TF_TOKEN_soc2_compliance_tf (dots become underscores), or add a credentials block:
credentials "soc2.compliance.tf" {
token = "ctf_YOUR_TOKEN_HERE"
}The hostname has to match the host in source exactly; a block for one host does nothing for another.
HTTPS URL format
module "..." {
source = "https://<framework>.compliance.tf/terraform-aws-modules/<module>/aws?version=<version>&enable=<controls>&disable=<controls>"
}Every query parameter is optional. Terraform fetches this format with its HTTP downloader, which reads credentials from ~/.netrc (or the file the NETRC variable names) and ignores .terraformrc and TF_TOKEN_*:
machine soc2.compliance.tf
login anything
password ctf_YOUR_TOKEN_HEREThe login value is not checked; the token goes in password. Add one machine entry per host you use, including registry.compliance.tf and your organization's host if you source from them.
Create a token on the Access tokens page; Registry tokens explains personal and organization tokens.
Parameters
| Parameter | Format | Value |
|---|---|---|
<framework> | Both | The framework's host label, from the table below |
<module> | Both | The terraform-aws-modules name, such as s3-bucket or cloudfront |
version argument | Registry | A version or constraint: 5.0.0, ~> 5.0, or a build-pinned version such as 5.1.0-98ddc498fa shown on the module page |
?version= | HTTPS | One exact version, such as 5.0.0. Omitting it serves the latest version; pin one outside experiments |
?enable= | HTTPS | Comma-separated control IDs to add to the framework's set |
?disable= | HTTPS | Comma-separated control IDs to remove from the framework's set |
What ?enable= and ?disable= can and cannot do is on Turn controls on and off.
Hosts for frequently used frameworks:
| Framework | Host label | Also accepted |
|---|---|---|
| SOC 2 | soc2 | soc-2 |
| PCI DSS v4.0 | pcidss | pcidssv40, pci-dss-v40 |
| PCI DSS v3.2.1 (superseded) | pcidssv321 | pci-dss-v321 |
| HIPAA Omnibus Rule 2013 | hipaa | hipaafinalomnibus2013 |
| CIS AWS Benchmark v6.0.0 | cis | cisv600, cis-v600 |
| NIST SP 800-53 Rev 5 | nist80053 | nist-800-53-rev5 |
| FedRAMP Moderate Rev 4 | fedrampmoderate | fedrampmoderaterev4 |
CIS AWS Benchmark v1.2.0, v1.3.0 and v1.4.0 are retired. Their hosts (cisv120, cis-v120, cisv130, cis-v130, cisv140, cis-v140) now serve CIS AWS Benchmark v6.0.0, so a source that names one of them gets the v6.0.0 control set.
Every framework page shows its host. Which frameworks your token can use depends on your plan; see Plans and entitlements.
Hosts with a special meaning
registry.compliance.tf serves each module with no controls. Use it with ?enable= to start from nothing and add the controls you choose, rather than starting from a framework's set and removing some.
Your organization's host, such as bobthecorp.compliance.tf, serves the posture your organization bound to it, including its Baseline rules. It honours ?version=; which other query parameters it accepts, and which it refuses with a 400, is on Rulesets in the console. How a module request resolves explains how the request is answered. The token must belong to that organization or one of its members.
Examples
SOC 2 controls, Registry format
module "s3_bucket" {
source = "soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws"
version = "5.0.0"
}HIPAA controls, Registry format
module "s3_bucket" {
source = "hipaa.compliance.tf/terraform-aws-modules/s3-bucket/aws"
version = "5.0.0"
}PCI DSS v4.0 controls, HTTPS format with a pinned version
module "s3_bucket" {
source = "https://pcidss.compliance.tf/terraform-aws-modules/s3-bucket/aws?version=5.0.0"
}SOC 2 controls with one control turned off
module "s3_bucket" {
source = "https://soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws?version=5.0.0&disable=s3_bucket_object_lock_enabled"
}No framework, one control added
module "s3_bucket" {
source = "https://registry.compliance.tf/terraform-aws-modules/s3-bucket/aws?version=5.0.0&enable=s3_bucket_versioning_enabled"
}Errors and limits
| What you see | Meaning | Fix |
|---|---|---|
401 during init | No credentials for this exact hostname | Add the credentials block, TF_TOKEN_* variable or .netrc entry for the host in source |
403 during init | The token is valid but your plan does not include this framework | Use a framework your plan includes; see Plans and entitlements |
404 during init | The namespace is not terraform-aws-modules, or the module name is wrong | Only terraform-aws-modules/* is served; see Compatibility with terraform-aws-modules |
400 on your organization's host | A posture override such as ?enable= or ?disable= | Remove it: the organization's binding decides the posture |
Cannot apply a version constraint to module ... because it has a non Registry URL | A version argument next to an HTTPS source | Move the version into ?version= |
| An HTTPS source fails while the Registry form works | .netrc has no entry for that host | Add a machine entry; .terraformrc and TF_TOKEN_* are not read for HTTPS sources |
The Registry format accepts no query parameters, and Terraform does not allow variables in source. To vary the controls per environment, give each environment root its own literal source; see Turn controls on and off. More about module sources: Terraform module sources.