vs Control Tower
Read this if you run AWS Control Tower across an AWS Organization today. You keep your landing zone, account factory, SCPs and detective controls. Compliance.tf works inside each account on what Control Tower does not set: the configuration of the resources your Terraform creates, served from one registry endpoint per organization, with a posture per project environment. This page is for the AWS Organization admin who runs many accounts.
Summary
| Dimension | Compliance.tf | AWS Control Tower |
|---|---|---|
| Level it acts on | Individual Terraform resources | AWS accounts and organizational units (OUs) |
| When it acts | terraform init (modules arrive with controls), terraform plan (module validations; provider checks before Terraform calls AWS) | On the AWS API call (preventive), before a CloudFormation resource is provisioned (proactive), after a change (detective) |
| Covers console, CLI and SDK actions | No: Terraform and OpenTofu only | Yes |
| Hand-written resources | The compliance.tf provider for AWS checks aws_* resources before apply | Covered by whichever controls apply to the account |
| Resource-level defaults | Yes: per-attribute values such as S3 encryption and logging | No: controls allow, deny or report |
| Framework mapping | Controls mapped to clause IDs on the framework pages | Controls carry framework metadata in the Control Catalog |
| Operational rules | Download-time rules from an org Baseline, including an allowed-regions allowlist on modules | Region deny and other controls at the account level |
| Structure | One organization, with projects that each have dev, staging and prod, each bound to its own snapshot | OUs and accounts |
| Governance and evidence | Snapshot approval, a promotion gate on protected environments, waivers with an expiry, an audit trail of posture changes | Control enablement per OU; activity in AWS CloudTrail |
| Drift after deployment | Not detected | Detective controls through AWS Config |
| Requires AWS Organizations | No | Yes |
| Cost | Paid subscription with a free trial | No separate charge; underlying services such as AWS Config are billed |
What each tool solves
Compliance.tf enforces framework controls on the resources your Terraform creates (S3 buckets, RDS instances, ECS services, Lambda functions) through modules served per framework, and checks the aws_* resources you write by hand through its provider. For an estate, an organization gets its own registry host. A module source names your project and environment instead of a framework:
source = "bobthecorp.compliance.tf/payments/prod/s3bucket"What that resolves to is the snapshot bound to payments/prod. Projects and environments and Configs and snapshots describe the model; Promotion and gates covers how a posture reaches production.
AWS Control Tower governs an AWS Organization. It provisions accounts through Account Factory and applies controls to OUs: preventive controls implemented as service control policies, detective controls implemented as AWS Config rules, and proactive controls implemented as CloudFormation hooks. (Control Tower used to call its controls "guardrails".)
Where compliance.tf is stronger
- It sets the resource configuration. Control Tower can deny an API call or report a finding; it does not set S3 encryption, RDS backup retention or a log group's retention on the resource you create. A compliance.tf module ships those values.
- Feedback in the Terraform workflow. A violation shows up at
terraform plan, before anything reaches AWS. An SCP denial arrives as an API error during apply, and a detective finding arrives after the resource exists. - One posture per environment, promoted on purpose. Every account's Terraform can pull from the same organization host, and
devandprodcan enforce different control sets. Moving a new posture into a protected environment needs an approved snapshot, and the act is recorded. - No landing zone required. It works in any AWS account, with or without AWS Organizations.
Where AWS Control Tower is stronger
- Every path into the account. Controls apply to console clicks, the AWS CLI, SDK calls, CloudFormation and CDK. Compliance.tf covers only resources created through Terraform or OpenTofu.
- Account-level restrictions. Denying a whole Region, or preventing anyone from disabling CloudTrail, is an account-level control that no module can provide.
- Account lifecycle. Account Factory provisions and enrolls accounts with a baseline. Compliance.tf has no account management.
- Drift detection. Detective controls report when a resource changes after deployment, including changes made outside Terraform. Compliance.tf does not see a resource after it is created.
- First-party integration. Control Tower integrates with IAM Identity Center, AWS Config, CloudTrail and Security Hub, maintained by AWS, with no separate charge beyond the underlying services.
Use both together
Use Control Tower for the account layer: allowed Regions, protected CloudTrail, account provisioning and detective controls.
Use compliance.tf for the resource layer inside every account: modules that arrive with the controls of your framework, the provider on hand-written resources, and one organization host whose project environments each serve a reviewed snapshot.
Example: Control Tower denies resource creation outside approved Regions and reports if CloudTrail is turned off. Compliance.tf serves every Terraform S3 bucket with encryption, access logging and a public access block. Control Tower does not set S3 encryption defaults; compliance.tf cannot stop a console user creating a resource in another Region.
The layers meet in detection. Detective controls also report resource-level misconfigurations; for resources built from compliance.tf modules those settings are in place at creation, and a later change made outside Terraform is what the detective layer is there to catch.
To see how an organization is set up, start at the Platform overview.
Related
- Compare approaches
- Platform overview
- Projects and environments
- Access control
- Make the case: build the internal argument for adopting it