Govern your organization
Platform overview
The Terraform modules are one half of compliance.tf. The other half is the platform that decides which compliance posture each team, project and environment receives, and records who decided it. These pages are for the admin who runs an organization on compliance.tf and for the auditor who checks how it is run. Start with the model below, then go to the page for the job in front of you.
An organization owns everything. Inside it, configs author a compliance posture and freeze it into immutable snapshots, while projects organize workloads into three fixed environments. A binding connects one environment to one snapshot, and that binding is what the registry consults when a terraform init arrives.
Pages by task
| To | Read |
|---|---|
| Set up your organization, its alias and its members | Organizations and members |
| Decide who may author, approve and promote | Access control |
Give each workload its own dev, staging and prod | Projects and environments |
| Author a posture and freeze it for review | Configs and snapshots |
| Put an approved posture into production, or grant an exception | Promotion and gates |
| Set operational rules for every module, or for one | Rulesets in the console |
| Give Terraform a credential | Registry tokens |
Find out why a terraform init received what it did | How a module request resolves |
| Choose or change a plan | Plans and entitlements |
| Show an auditor who changed what, and when | The audit trail |
Start from your role
- You run the organization across many AWS accounts and teams. Set up projects and environments, keep one Baseline for every module served from your organization's own host, and assign who may approve before anyone promotes to
prod. - You assess the controls for an audit. Read The audit trail for the record of each decision, Audit evidence for what the modules and the provider produce, and Access control for where separation of duties stands.
- You own the compliance program. Read Promotion and gates for how a posture and its exceptions reach production, then Make the case for the governance summary to take to leadership.