Terraform AWS ALB
Application Load Balancers with listeners, listener rules, target groups, TLS certificates, access logs, WAF integration, and security group restricted ingress.
Quick start
module "alb" {
source = "nist800171.compliance.tf/terraform-aws-modules/alb/aws"
version = "~> 10.5"
# ... your arguments here
}module "alb" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/alb/aws"
version = "~> 10.5"
# ... your arguments here
}module "alb" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/alb/aws"
version = "~> 10.5"
# ... your arguments here
}module "alb" {
source = "nist80053.compliance.tf/terraform-aws-modules/alb/aws"
version = "~> 10.5"
# ... your arguments here
}module "alb" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/alb/aws"
version = "~> 10.5"
# ... your arguments here
}module "alb" {
source = "hipaa.compliance.tf/terraform-aws-modules/alb/aws"
version = "~> 10.5"
# ... your arguments here
}module "alb" {
source = "nydfs23.compliance.tf/terraform-aws-modules/alb/aws"
version = "~> 10.5"
# ... your arguments here
}module "alb" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/alb/aws"
version = "~> 10.5"
# ... your arguments here
}This module on the compliance.tf registry lists its versions, inputs and outputs. The Get Started guide and Registry Endpoints cover authentication and how to customize the module for your requirements.
Migration from upstream
Already using terraform-aws-modules? Change only the source URL:
module "alb" {
source = "terraform-aws-modules/alb/aws"
version = "~> 10.5"
}module "alb" {
source = "soc2.compliance.tf/terraform-aws-modules/alb/aws"
version = "~> 10.5"
}Same arguments. Same outputs. Controls are checked at terraform plan. The Migration Guide has the step-by-step version.
Reversibility
No lock-in. Switch back by reverting the source URL:
module "alb" {
source = "terraform-aws-modules/alb/aws"
}Run terraform init -upgrade. Terraform state is unchanged: same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.
Controls enforced
Up to 11 controls are checked at terraform plan when this module comes from a compliance.tf endpoint. Which ones are active depends on the endpoint; see Framework coverage.
Mapped compliance frameworks
| Clause | Controls from this module |
|---|---|
| 3.1.12: Monitor and control remote access sessions. | |
| 3.1.3: Control the flow of CUI in accordance with approved authorizations. | |
| 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems. | |
| 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems | |
| 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks | |
| 3.14.7: Identify unauthorized use of organizational systems. | |
| 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity | |
| 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles |
| Clause | Controls from this module |
|---|---|
| Detection | |
| Identity and access management |
| Clause | Controls from this module |
|---|---|
| AC-4: Information Flow Enforcement | |
| AU-12(a)(c) | |
| AU-2(a)(d) | |
| AU-6(1)(3) | |
| Content of Audit Records (AU-3) | |
| Denial Of Service Protection (SC-5) | |
| Information System Recovery And Reconstitution (CP-10) | |
| SC-7: Boundary Protection |
| Clause | Controls from this module |
|---|---|
| AC-4(26) Audit Filtering Actions | |
| AU-12(1) System-Wide And Time-Correlated Audit Trial | |
| AU-12(2) Standardized Formats | |
| AU-12(3) Changes By Authorized Individuals | |
| AU-12(4) Query Parameter Audits Of Personally Identifiable Information | |
| AU-12(a) | |
| AU-12(c) | |
| AU-14(3) Remote Viewing And Listening | |
| AU-14(a) | |
| AU-14(b) | |
| AU-2(b) | |
| AU-3(a) | |
| AU-3(b) | |
| AU-3(c) | |
| AU-3(d) | |
| AU-3(e) | |
| AU-3(f) | |
| AU-6(3) Correlate Audit Record Repositories | |
| AU-6(4) Central Review And Analysis | |
| AU-6(6) Correletion With Physical Monitoring | |
| AU-6(9) Correletion With From Nontechnical Sources | |
| AU-8(b) | |
| Architecture And Provisioning For Name/Address Resolution Service (SC-22) | |
| CA-7(4)(c) | |
| CA-7(b) | |
| CM-2(2) Automation Support For Accuracy And Currency | |
| CM-2(a) | |
| CM-3(a) | |
| CM-5(1)(b) | |
| CM-8(6) Assessed Configurations And Approved Deviations | |
| CP-1(a)(1)(b) | |
| CP-2(5) Continue Mission And Business Functions | |
| CP-2(a) | |
| CP-2(d) | |
| CP-2(e) | |
| Continuous Monitoring Strategy (PM-31) | |
| IA-3(3)(b) | |
| MA-4(1)(a) | |
| Non-Repudiation (AU-10) | |
| PM-14(a)(1) | |
| PM-14(b) | |
| SA-15(a)(4) | |
| SC-5(2) Capacity, Bandwidth, And Redundancy | |
| SC-7(13): Isolation Of Security Tools, Mechanisms, And Support Components | |
| SC-7(9)(b) | |
| SC-7: Boundary Protection | |
| SI-4(17) Integrated Situational Awareness | |
| SI-7(8) Auditing Capability For Significant Events |
| Clause | Controls from this module |
|---|---|
| 11.10(a) Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records | |
| 11.10(d) Limiting system access to authorized individuals | |
| 11.10(e) Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records | |
| 11.30 Controls for open systems |
| Clause | Controls from this module |
|---|---|
| 164.308(a)(1)(ii)(B) Risk Management | |
| 164.308(a)(1)(ii)(D): Administrative Safeguards | |
| 164.308(a)(3)(ii)(A) Authorization and/or supervision | |
| 164.308(a)(6)(ii) Response and reporting | |
| 164.312(b) Audit controls | |
| 164.312(e)(2)(ii) Encryption |
| Clause | Controls from this module |
|---|---|
| 500.02(a) | |
| 500.02(b)(2) | |
| 500.14(a) | |
| 500.15(a) |
| Clause | Controls from this module |
|---|---|
| Annex I (1.3) | |
| Annex I (7.4) |
Framework coverage
Which controls from this module are active under each framework endpoint. Your framework preferences choose the columns.
11 controls enforced with a source URL change.