AWS compliance frameworks
Compliance.tf supports 33 AWS compliance frameworks spanning industry standards, government mandates, and security benchmarks. Each framework maps to a dedicated Terraform registry endpoint. When you source a supported terraform-aws-modulesmodule through that endpoint, compliance.tf applies the framework's technical controls to the module configuration. Every endpoint is also a browsable public registry — for example soc2.compliance.tf — with module versions, inputs, and outputs, no account needed. Each framework page below links to its own registry host.
Enforced counts the controls a compliance.tf module checks at terraform plan; mapped counts every control the framework lists for AWS. Choose which frameworks appear in navigation.
The 30-day trial covers every framework on this page. After it, Full Access keeps all of them, billed through AWS Marketplace.
Core frameworks
| Framework | Enforced | Mapped | Market |
|---|---|---|---|
| SOC 2Service Organization Control 2 (SOC 2) is an auditing framework developed by the American Institute of Certified Public Accountants (AICPA) for evalua... | 90 | 142 | General |
| PCI DSS v4.0The Payment Card Industry Data Security Standard (PCI DSS) version 4.0 is an information security standard for organizations that handle branded credi... | 105 | 170 | General, Financial Services |
| HIPAA Omnibus Rule 2013The Health Insurance Portability and Accountability Act (HIPAA) Omnibus Final Rule of 2013 strengthened privacy and security protections for health in... | 70 | 104 | General, Healthcare/Life Sciences |
| ISO/IEC 27001:2022ISO/IEC 27001:2022 is the international standard for information security management systems (ISMS). | 93 | 166 | General |
| GDPRThe General Data Protection Regulation (GDPR) is a comprehensive data privacy law that regulates how personal data of individuals within the European ... | 29 | 50 | General, Regional |
| NIS2 Directive (EU 2022/2555)The NIS2 Directive (EU 2022/2555) is the European Union's updated cybersecurity legislation that strengthens security requirements for essential and i... | 51 | 101 | Regional |
| NIST SP 800-53 Rev 5The National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5 provides a comprehensive catalog of security and priva... | 73 | 98 | Public Sector |
| NIST Cybersecurity Framework v2.0The National Institute of Standards and Technology (NIST) Cybersecurity Framework version 2. | 87 | 134 | General |
| FedRAMP Moderate Baseline Rev 4The Federal Risk and Authorization Management Program (FedRAMP) Moderate Impact Baseline Revision 4 establishes security requirements for cloud servic... | 67 | 98 | Public Sector |
Common frameworks
| Framework | Enforced | Mapped | Market |
|---|---|---|---|
| CIS AWS Benchmark v6.0.0The Center for Internet Security (CIS) AWS Foundations Benchmark version 6.0. | 17 | 28 | AWS-specific |
| CIS Controls v8.0 IG1The Center for Internet Security (CIS) Controls version 8.0 is a prioritized set of actions to protect organizations from known cyber attack vectors. | 35 | 50 | General |
| NIST SP 800-171 Rev 2The National Institute of Standards and Technology (NIST) Special Publication 800-171 Revision 2 provides guidelines for protecting Controlled Unclass... | 72 | 106 | Public Sector |
| AWS Control Tower GuardrailsAWS Control Tower Guardrails are high-level rules that provide ongoing governance for AWS Control Tower environments. | 11 | 14 | AWS-specific |
| AWS Well-Architected Framework v10The AWS Well-Architected Framework helps cloud architects build secure, high-performing, resilient, and efficient infrastructure for applications and ... | 72 | 123 | AWS-specific |
| CISA Cyber EssentialsThe Cybersecurity and Infrastructure Security Agency (CISA) Cyber Essentials is a guide for leaders of small businesses and state, local, tribal, and ... | 58 | 86 | AWS-specific |
| NYDFS Cybersecurity RegulationThe New York Department of Financial Services (NYDFS) Cybersecurity Requirements for Financial Services Companies, codified as 23 NYCRR 500, establish... | 50 | 73 | Financial Services |
| CIS AWS Benchmark v5.0.0The Center for Internet Security (CIS) AWS Foundations Benchmark version 5.0. | 17 | 28 | AWS-specific |
Specialized frameworks
| Framework | Enforced | Mapped | Market |
|---|---|---|---|
| FFIEC Cybersecurity Assessment ToolThe Federal Financial Institutions Examination Council (FFIEC) Cybersecurity Assessment Tool helps financial institutions identify cybersecurity risks... | 60 | 85 | Financial Services |
| CCCS Medium Cloud Control ProfileThe Canadian Centre for Cyber Security (CCCS) Medium Cloud Control Profile provides security control baselines for cloud services used by the Governme... | 12 | 24 | Public Sector, Regional |
| ACSC Essential EightThe Australian Cyber Security Centre (ACSC) Essential Eight is a baseline cybersecurity framework designed to protect Australian organizations against... | 42 | 65 | Regional |
| ACSC ISM March 2023The Australian Cyber Security Centre (ACSC) Information Security Manual (ISM) is a comprehensive cybersecurity framework developed by the Australian G... | 17 | 26 | Regional |
| EU GMP Annex 11The European Union Good Manufacturing Practice (GMP) Annex 11 provides guidance on computerized systems used in pharmaceutical manufacturing and quali... | 65 | 85 | Healthcare/Life Sciences |
| Title 21 CFR Part 11The Code of Federal Regulations (CFR) is the codification of the general and permanent rules published in the Federal Register by the departments and ... | 76 | 110 | Healthcare/Life Sciences |
| RBI Cyber Security Framework for UCBsThe Reserve Bank of India (RBI) Cyber Security Framework for Urban Cooperative Banks (UCBs) provides baseline cybersecurity standards for urban cooper... | 57 | 80 | Financial Services, Regional |
| RBI IT Framework for NBFCsThe Reserve Bank of India (RBI) Information Technology Framework for Non-Banking Financial Companies (NBFCs) establishes IT governance, security, and ... | 44 | 60 | Financial Services, Regional |
| AWS Generative AI Best Practices v2The AWS Generative AI Best Practices Framework version 2 provides guidance for building, deploying, and operating generative AI applications on AWS in... | 2 | 5 | AWS-specific |
| FedRAMP Low Baseline Rev 4The Federal Risk and Authorization Management Program (FedRAMP) Low Impact Baseline Revision 4 establishes security requirements for cloud services ha... | 55 | 75 | Public Sector |
Retired frameworks
Superseded versions, kept for reference.
| Framework | Mapped |
|---|---|
| CIS Controls v7.1 IG1The Center for Internet Security (CIS) Controls version 7.1 is a prioritized set of actions to protect organizations from known cyber attack vectors. | 2 |
| HIPAA Security Rule 2003The Health Insurance Portability and Accountability Act (HIPAA) Security Rule, published in February 2003, establishes national standards to protect e... | 69 |
| ISO/IEC 27001:2013The International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) 27001:2013 standard specifies requirement... | 34 |
| NIST Cybersecurity Framework v1.1The National Institute of Standards and Technology (NIST) Cybersecurity Framework version 1. | 139 |
| NIST SP 800-53 Rev 4The National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 4 provides a catalog of security and privacy controls fo... | 73 |
| PCI DSS v3.2.1The Payment Card Industry Data Security Standard (PCI DSS) version 3.2.1 is an information security standard for organizations that handle branded cre... | 105 |
Compliance.tf modules apply framework requirements with a single module source change.