ISO 27001 controls built into your Terraform modules. Enforced before apply.
Annex A technological controls ask for encryption, logging, access management and network security on AWS resources. The modules enforce these controls before apply and list the Annex A control each one maps to, where the catalog names one.
Modules enforce 93 of 166 ISO 27001 controls in the catalog. Of the 140 that cite a ISO 27001 clause, they enforce 78. The controls they do not enforce stay with your team, with your ISMS, risk treatment, internal audits and physical security.
No credit card or AWS account needed to start. By Anton Babenko, maintainer of terraform-aws-modules, more than 2 billion provisions.
Annex D: ISO 27001
- Framework
- ISO/IEC 27001:2022, Annex A
- For
- Your team, on Terraform
Scope for ISO 27001
Enterprise procurement teams, often in Europe and Asia-Pacific, ask for an ISO 27001 certificate before they sign.
Covers
- Infrastructure controls on AWS resources that map to ISO/IEC 27001:2022 Annex A controls, by theme in D.3.
- terraform-aws-modules through the ISO 27001 framework host or your org endpoint. Once your team switches to the compliance.tf provider, resources written by hand outside modules are checked against its built-in CIS controls, not the ISO 27001 set.
Stays with your team
- The ISMS and its documentation.
- Risk assessment and treatment plans (clauses 6.1 and 8.2).
- Management reviews and internal audits (clauses 9.2 and 9.3).
- Competence, awareness and training (clause 7.2).
- Incident management procedures (A.5.24 to A.5.28).
- Supplier relationship security (A.5.19 to A.5.23).
- Physical security controls (A.7).
- Resources outside compliance.tf module coverage, and every control D.4 lists as Mapped: 62 with a ISO 27001 clause and 11 without one.
The source line
Point a module at the ISO 27001 framework host. Same inputs and outputs, no state migration. Terraform 1.0 or later.
- source = "terraform-aws-modules/s3-bucket/aws" + source = "iso27001.compliance.tf/terraform-aws-modules/s3-bucket/aws" version = "~> 5.0"
With an org endpoint, the source names your org host instead, and ISO 27001 comes from your org's configuration.
Enforced and mapped, by theme
Of the 140 ISO 27001 controls in the documented catalog that cite a clause, modules enforce 78. A control appears once under each theme it maps to.
The catalog maps 26 more controls to ISO 27001 without naming a clause, 15 of them enforced. They are listed apart at the end of D.4 and left out of these counts.
Every row is a control your auditor can look up.
Filter the register, or search by control name or clause, for example A.8.24.
140 of 140 shown
Each control links to its public docs page.
- Enforced
- Modules set this control before anything is deployed.
- Mapped
- Documented on its docs page, not set by modules. Your team owns it.
Control register
Supporting: the control is partial or indirect evidence for the clause, not full enforcement.
Enforced or mapped without a named ISO 27001 clause
The catalog lists these 26 controls under ISO 27001 but names no ISO 27001 clause for them, so the register and the counts in D.3 leave them out. Each still links to its docs page.
Clause IDs for the auditor. Your stack stays as it is.
Compliance.tf works alongside your scanners, plan policy, CSPM and GRC tool. It sets the controls in the modules and lists the clause each one is there for.
Evidence
What compliance.tf gives your auditor
- The ISO 27001 clause IDs behind each enforced setting, with stable control IDs and public docs pages.
- The config snapshot bound to each environment, and the per-action audit log of promotions between environments.
What comes from your AWS account and GRC tool
Evidence of what actually runs comes from your own account, for example AWS Config and your CSPM. Your GRC tool keeps tracking policies and audit workflows.
Related reading
Make Non-Compliant Terraform Impossible, Why Enterprises Choose Compliance.tf, the comparisons with other tools, and the ISO 27001 framework registry at iso27001.compliance.tf.
Plans for ISO 27001
ISO 27001 is in the 30-day trial and in Full Access, $1,000 a year on AWS Marketplace. Schedule of fees.
Questions about ISO 27001
Is this ISO 27001:2013 or 2022?
Compliance.tf maps controls to ISO 27001:2022, the current version. The 2022 revision restructured Annex A from 114 controls in 14 domains to 93 controls in 4 themes (Organizational, People, Physical, Technological). Our modules focus on the Technological theme (A.8), which maps directly to AWS resource configuration.
Which Annex A controls does this cover?
Compliance.tf enforces controls from Annex A, for example cryptography (A.8.24), logging and monitoring (A.8.15 and A.8.16), access control (A.8.2 to A.8.5), network security (A.8.20 to A.8.22), and information deletion (A.8.10). These are the Annex A controls that translate directly to infrastructure configuration.
Can I adopt this gradually, or is it all-or-nothing?
Fully incremental. Start with one module in one environment. Your existing modules continue working untouched. If you use Terragrunt or Terramate to orchestrate your runs, nothing changes - you're only swapping the module source line. There is no global policy agent to deploy, no wrapper binary, no sidecar. Each module source line is independent.
What if we want to switch back?
Each module keeps the inputs and outputs of its terraform-aws-modules counterpart and needs no state migration, so switching back is the same source line change in reverse.