Terraform AWS EKS
EKS clusters with managed node groups, Fargate profiles, cluster encryption, IAM and OIDC integration, VPC networking, control plane logging, security groups, and core add-ons.
Quick start
module "eks" {
source = "iso27001.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
# ... your arguments here
}module "eks" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
# ... your arguments here
}module "eks" {
source = "pcidss.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
# ... your arguments here
}module "eks" {
source = "nist800171.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
# ... your arguments here
}module "eks" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
# ... your arguments here
}module "eks" {
source = "nis2.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
# ... your arguments here
}module "eks" {
source = "nistcsf.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
# ... your arguments here
}module "eks" {
source = "soc2.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
# ... your arguments here
}This module on the compliance.tf registry lists its versions, inputs and outputs. The Get Started guide and Registry Endpoints cover authentication and how to customize the module for your requirements.
Migration from upstream
Already using terraform-aws-modules? Change only the source URL:
module "eks" {
source = "terraform-aws-modules/eks/aws"
version = "~> 21.26"
}module "eks" {
source = "soc2.compliance.tf/terraform-aws-modules/eks/aws"
version = "~> 21.26"
}Same arguments. Same outputs. Controls are checked at terraform plan. The Migration Guide has the step-by-step version.
Reversibility
No lock-in. Switch back by reverting the source URL:
module "eks" {
source = "terraform-aws-modules/eks/aws"
}Run terraform init -upgrade. Terraform state is unchanged: same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.
Controls enforced
Up to 11 controls are checked at terraform plan when this module comes from a compliance.tf endpoint. Which ones are active depends on the endpoint; see Framework coverage.
Mapped compliance frameworks
| Clause | Controls from this module |
|---|---|
| A.8.15 Logging | |
| A.8.16 Monitoring activities | |
| A.8.20 Network security | |
| A.8.21 Security of network services | |
| A.8.22 Segregation of networks | |
| A.8.24 Use of cryptography | |
| A.8.3 Information access restriction |
| Clause | Controls from this module |
|---|---|
| Data protection | |
| Detection | |
| Identity and access management | |
| Infrastructure protection |
| Clause | Controls from this module |
|---|---|
| 1.2.8: Network security controls (NSCs) are configured and maintained. | |
| 1.3.1: Network access to and from the cardholder data environment is restricted. | |
| 1.3.2: Network access to and from the cardholder data environment is restricted. | |
| 1.4.2: Network connections between trusted and untrusted networks are controlled. | |
| 1.4.5 The disclosure of internal IP addresses and routing information is limited to only authorized parties | |
| 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks | |
| 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.3.1: Audit logs are protected from destruction and unauthorized modifications. | |
| 10.3.2: Audit logs are protected from destruction and unauthorized modifications. | |
| 10.3.3: Audit log files, including those for externalfacing technologies, are promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify | |
| 10.3.4: File integrity monitoring or change-detection mechanisms is used on audit logs to ensure that existing log data cannot be changed without generating alerts | |
| 10.5.1: Retain audit log history for at least 12 months, with at least the most recent three months immediately available for analysis | |
| 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. | |
| 3.2.1: Storage of account data is kept to a minimum. | |
| 3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. | |
| 3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. | |
| 3.3.2: Sensitive authentication data (SAD) is not stored after authorization. | |
| 3.3.3: Sensitive authentication data (SAD) is not stored after authorization. | |
| 3.5.1: Primary account number (PAN) is secured wherever it is stored. | |
| 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. | |
| 8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components | |
| A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. | |
| A1.2.3: Processes or mechanisms are implemented for reporting and addressing suspected or confirmed security incidents and vulnerabilities |
| Clause | Controls from this module |
|---|---|
| 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems) | |
| 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute. | |
| 3.1.3 Control the flow of CUI in accordance with approved authorizations | |
| 3.1.3: Control the flow of CUI in accordance with approved authorizations. | |
| 3.13.11 Employ FIPS-validated cryptography when used to protect the confidentiality of CUI | |
| 3.13.16: Protect the confidentiality of CUI at rest. | |
| 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems. | |
| 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity | |
| 3.3.8: Protect audit information and audit logging tools from unauthorized access, modification, and deletion. | |
| 3.6.1 Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities | |
| 3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization |
| Clause | Controls from this module |
|---|---|
| 12.1 Security | |
| 17 Archiving | |
| 7.1 Data Storage - Damage Protection |
| Clause | Controls from this module |
|---|---|
| 1 Policy on the security of network and information systems | |
| 12 Asset management | |
| 3 Incident handling | |
| 4 Business continuity and crisis management |
| Clause | Controls from this module |
|---|---|
| PR.DS-01 | |
| PR.DS-1 | |
| PR.DS-5 | |
| RC.RP-06 |
| Clause | Controls from this module |
|---|---|
| C1.2 The entity disposes of confidential information to meet the entity's objectives related to confidentiality | |
| CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives | |
| CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries. | |
| CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events. | |
| CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures | |
| P4.2 The entity retains personal information consistent with the entity's objectives related to privacy | |
| PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements |
Framework coverage
Which controls from this module are active under each framework endpoint. Your framework preferences choose the columns.
| Control | PCI DSS v4.0 | SOC 2 |
|---|---|---|
| CloudWatch log groups should have retention period of at least 365 days | Enforced | Enforced |
| EC2 launch templates should use Instance Metadata Service Version 2 (IMDSv2) | Not active | Enforced |
| EC2 launch templates should not assign public IPs to network interfaces | Enforced | Enforced |
| EKS clusters should have control plane audit logging enabled | Enforced | Not active |
| EKS clusters endpoint public access should be restricted | Enforced | Not active |
| EKS clusters endpoint should restrict public access | Not active | Not active |
| Log groups should have encryption at rest enabled | Enforced | Enforced |
| SQS queues should have encryption at rest enabled | Not active | Not active |
| SQS queues should be encrypted with KMS CMK | Not active | Not active |
| VPC Security groups should only allow unrestricted incoming traffic for authorized ports | Enforced | Not active |
| VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888 | Enforced | Not active |
Known Terraform limitations
Separately from the controls above, some things people ask this module for cannot be implemented by any module in any registry: they are limits of Terraform itself. Known limitations for this module lists the recurring ones: what causes each, the native workaround in full, and, where one exists, the opt-in Operational Rule that removes the need for a fork.
11 controls enforced with a source URL change.