What are control overrides?
Control overrides are module-scoped adjustments to the compliance controls enforced by a compliance.tf module, declared by appending enable or disable query parameters to an HTTPS module source URL.
Why it matters
No framework ships a control set that suits every resource. Take Object Lock retention for data already stored in a bucket: it must run against every existing object version, which is seldom worth the effort in a development account. With an override, a team can turn one control off for a single module, or turn on a control the framework omits, while still using the registry. For an auditor, the question is where that exception is written down and who approved it.
How compliance.tf applies it
There are two places an exception can live, and which one applies depends on the host in the module source.
On a framework endpoint (soc2.compliance.tf and the others), the override is a query parameter on the HTTPS URL form of the source; the registry address form carries no query string:
module "s3_bucket" {
source = "https://soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws?version=5.0.0&disable=s3_bucket_object_lock_enabled"
bucket = "my-app-data-dev"
}source = "https://soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws?version=5.0.0&enable=s3_bucket_default_encryption_enabled_kms"The exception is in reviewed code: it shows in the pull request, in Git history and in .terraform/modules/modules.json. On the canonical endpoint, registry.compliance.tf, no controls are enforced; there, enable is the mechanism for selecting controls individually.
On an organization's own host (<alias>.compliance.tf), ?enable= and ?disable= are refused with an HTTP 400 on both address forms. On a project environment (<alias>.compliance.tf/<project>/<env>/<module>) the control set comes from the config snapshot bound to that environment; on the organization's own module path it comes from the default posture the organization published for that host (see Rulesets in the console). A control is removed from a posture through the config's forbidden list before publishing, or excepted for one environment with a waiver: proposed and approved as separate acts by someone holding snapshot:approve, carrying an expiry, and frozen into the binding at the next promotion. Each waiver decision is recorded in the audit trail.
Where it ends
- The free plan cannot turn controls outside CIS v6.0 on or off. See Plans and entitlements.
- A query parameter records no reason. Write down the reason, any compensating control and the approver alongside the change. ctfkit, the compliance.tf CI checker, flags a disabled control as a finding, so the exception appears in CI too.
- Separation of duties is off by default for waivers and promotions; enabling it for an organization is operator-assisted.