Terraform AWS VPC

VPCs with public and private subnets, route tables, NAT gateways, Internet gateways, VPC endpoints, flow logs, network ACLs, and security group foundations for workload isolation.

Quick start

module "vpc" {
  source  = "iso27001.compliance.tf/terraform-aws-modules/vpc/aws"
  version = "~> 6.7"

  # ... your arguments here
}

module "vpc" {
  source  = "soc2.compliance.tf/terraform-aws-modules/vpc/aws"
  version = "~> 6.7"

  # ... your arguments here
}

module "vpc" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/vpc/aws"
  version = "~> 6.7"

  # ... your arguments here
}

module "vpc" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/vpc/aws"
  version = "~> 6.7"

  # ... your arguments here
}

module "vpc" {
  source  = "fedramplow.compliance.tf/terraform-aws-modules/vpc/aws"
  version = "~> 6.7"

  # ... your arguments here
}

module "vpc" {
  source  = "fedrampmoderate.compliance.tf/terraform-aws-modules/vpc/aws"
  version = "~> 6.7"

  # ... your arguments here
}

module "vpc" {
  source  = "hipaa.compliance.tf/terraform-aws-modules/vpc/aws"
  version = "~> 6.7"

  # ... your arguments here
}

module "vpc" {
  source  = "nist800171.compliance.tf/terraform-aws-modules/vpc/aws"
  version = "~> 6.7"

  # ... your arguments here
}

This module on the compliance.tf registry lists its versions, inputs and outputs. The Get Started guide and Registry Endpoints cover authentication and how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 6.7"
}

module "vpc" {
  source  = "soc2.compliance.tf/terraform-aws-modules/vpc/aws"
  version = "~> 6.7"
}

Same arguments. Same outputs. Controls are checked at terraform plan. The Migration Guide has the step-by-step version.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
}

Run terraform init -upgrade. Terraform state is unchanged: same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Controls enforced

Up to 4 controls are checked at terraform plan when this module comes from a compliance.tf endpoint. Which ones are active depends on the endpoint; see Framework coverage.

Control	Retrofit effort
CloudWatch log groups should have retention period of at least 365 days	Low
Log groups should have encryption at rest enabled	Low
EC2 VPC Block Public Access settings should block internet gateway traffic	Low
VPC subnet auto assign public IP should be disabled	Low

Mapped compliance frameworks

Clause	Controls from this module
A.8.15 Logging	CloudWatch log groups should have retention period of at least 365 days Log groups should have encryption at rest enabled
A.8.16 Monitoring activities	CloudWatch log groups should have retention period of at least 365 days Log groups should have encryption at rest enabled
A.8.20 Network security	VPC subnet auto assign public IP should be disabled
A.8.21 Security of network services	VPC subnet auto assign public IP should be disabled
A.8.22 Segregation of networks	VPC subnet auto assign public IP should be disabled
A.8.24 Use of cryptography	Log groups should have encryption at rest enabled
A.8.3 Information access restriction	EC2 VPC Block Public Access settings should block internet gateway traffic

Clause	Controls from this module
C1.2 The entity disposes of confidential information to meet the entity's objectives related to confidentiality	CloudWatch log groups should have retention period of at least 365 days
CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.	EC2 VPC Block Public Access settings should block internet gateway traffic VPC subnet auto assign public IP should be disabled
CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.	CloudWatch log groups should have retention period of at least 365 days
CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures	CloudWatch log groups should have retention period of at least 365 days Log groups should have encryption at rest enabled
P4.2 The entity retains personal information consistent with the entity's objectives related to privacy	CloudWatch log groups should have retention period of at least 365 days
PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements	Log groups should have encryption at rest enabled

Clause	Controls from this module
11.10(c) Protection of records to enable their accurate and ready retrieval throughout the records retention period	CloudWatch log groups should have retention period of at least 365 days
11.10(d) Limiting system access to authorized individuals	VPC subnet auto assign public IP should be disabled
11.10(e) Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records	CloudWatch log groups should have retention period of at least 365 days
11.30 Controls for open systems	Log groups should have encryption at rest enabled

Clause	Controls from this module
12.1 Security	VPC subnet auto assign public IP should be disabled
17 Archiving	CloudWatch log groups should have retention period of at least 365 days
7.1 Data Storage - Damage Protection	Log groups should have encryption at rest enabled

Clause	Controls from this module
Audit Record Retention (AU-11)	CloudWatch log groups should have retention period of at least 365 days
Boundary Protection (SC-7)	VPC subnet auto assign public IP should be disabled
Protection of Audit Information (AU-9)	Log groups should have encryption at rest enabled

Clause	Controls from this module
AU-6(1)(3)	CloudWatch log groups should have retention period of at least 365 days
Audit Record Retention (AU-11)	CloudWatch log groups should have retention period of at least 365 days
Information Handling and Retention (SI-12)	CloudWatch log groups should have retention period of at least 365 days
Protection of Audit Information (AU-9)	Log groups should have encryption at rest enabled
Protection of Information at Rest (SC-28)	Log groups should have encryption at rest enabled

Clause	Controls from this module
164.308(a)(1)(ii)(B) Risk Management	Log groups should have encryption at rest enabled
164.308(a)(4)(ii)(A) Isolating health care clearinghouse functions	Log groups should have encryption at rest enabled
164.312(a)(2)(iv) Encryption and decryption	Log groups should have encryption at rest enabled
164.312(b) Audit controls	CloudWatch log groups should have retention period of at least 365 days
164.312(e)(1) Transmission security	VPC subnet auto assign public IP should be disabled
164.312(e)(2)(ii) Encryption	Log groups should have encryption at rest enabled

Clause	Controls from this module
3.13.11 Employ FIPS-validated cryptography when used to protect the confidentiality of CUI	Log groups should have encryption at rest enabled
3.13.16: Protect the confidentiality of CUI at rest.	Log groups should have encryption at rest enabled
3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity	CloudWatch log groups should have retention period of at least 365 days
3.3.8: Protect audit information and audit logging tools from unauthorized access, modification, and deletion.	Log groups should have encryption at rest enabled
3.6.1 Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities	CloudWatch log groups should have retention period of at least 365 days
3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization	CloudWatch log groups should have retention period of at least 365 days

Framework coverage

Which controls from this module are active under each framework endpoint. Your framework preferences choose the columns.

Control	SOC 2	HIPAA Omnibus Rule 2013
CloudWatch log groups should have retention period of at least 365 days	Enforced	Enforced
Log groups should have encryption at rest enabled	Enforced	Enforced
EC2 VPC Block Public Access settings should block internet gateway traffic	Enforced	Not active
VPC subnet auto assign public IP should be disabled	Enforced	Enforced

Known Terraform limitations

Separately from the controls above, some things people ask this module for cannot be implemented by any module in any registry: they are limits of Terraform itself. Known limitations for this module lists the recurring ones: what causes each, the native workaround in full, and, where one exists, the opt-in Operational Rule that removes the need for a fork.

4 controls enforced with a source URL change.

Start free trial Get started