VPC

For an engineer moving an existing VPC from terraform-aws-modules to compliance.tf. Under SOC 2 the module enforces one control: subnets do not assign public IP addresses on launch. When you finish, terraform plan passes with the compliance.tf source.

Minor fixes · 10-15 minutes per instance · No state moves · Upstream v6.x

Before you start

A registry token, set up as in Registry tokens. The registry host for each framework is on Registry endpoints.
An upstream version inside the supported range (v6.x). Older versions: upgrade upstream first, see Version compatibility.
State: No terraform state mv. Resource addresses stay the same, because compliance.tf modules keep the upstream resource structure. If a control adds a resource, the plan shows it as an addition.
Not sure if this module should go first? The Migration kit tells you where to start. The Assessment checklist finds risks before you plan.

Change the source

The diff changes the source and adds the settings this module's controls need, so the plan passes. Replace the referenced resources (aws_...) with your own.

 module "vpc" {
-  source  = "terraform-aws-modules/vpc/aws"
+  source  = "soc2.compliance.tf/terraform-aws-modules/vpc/aws"
   version = "~> 6.0"

   name = "my-vpc"
   cidr = "10.0.0.0/16"

   azs             = ["eu-west-1a", "eu-west-1b"]
   public_subnets  = ["10.0.1.0/24", "10.0.2.0/24"]
   private_subnets = ["10.0.101.0/24", "10.0.102.0/24"]

+  map_public_ip_on_launch = false
+
   tags = {
     Environment = "production"
   }
 }

 module "vpc" {
-  source  = "terraform-aws-modules/vpc/aws"
+  source  = "pcidss.compliance.tf/terraform-aws-modules/vpc/aws"
   version = "~> 6.0"

   name = "my-vpc"
   cidr = "10.0.0.0/16"

   azs             = ["eu-west-1a", "eu-west-1b"]
   public_subnets  = ["10.0.1.0/24", "10.0.2.0/24"]
   private_subnets = ["10.0.101.0/24", "10.0.102.0/24"]

   tags = {
     Environment = "production"
   }
 }

Then download the new source and plan. terraform init installs a module whose source changed; -upgrade is only for fetching the same source and version again:

terraform init
terraform plan

After init, .terraform/modules/<module name>/compliancetf-manifest.json names the framework the module was built for.

Fix the plan errors

Each error names the control and links its page, which lists the frameworks that map it. These are the ones this module raises most often.

Public subnets assign public IP addresses (SOC 2 only)

The control requires map_public_ip_on_launch = false. Many configurations set it to true for public subnets. Control: vpc_subnet_auto_assign_public_ip_disabled.

Set it to false. Give instances that need a public address an Elastic IP, or send their traffic through a load balancer or NAT gateway.

map_public_ip_on_launch = false

A control that does not apply to this instance can be turned off on the source URL; see Turn controls on and off.

Controls this enforces

SOC 2

VPC subnet auto assign public IP should be disabled

PCI DSS v4.0

This module enforces no PCI DSS v4.0 controls.

Each framework also maps controls that this module does not enforce. Those stay with your team; the module page lists enforced and mapped-only controls apart.

Roll back

Point the source back at terraform-aws-modules/vpc/aws, keeping the same version constraint.
Run terraform init.
Run terraform plan. Expect no resource changes: the values you added stay in place, but compliance.tf no longer checks them.

VPC