PCI DSS v4.0 Registry

Compliance-ready Terraform modules with PCI DSS v4.0 controls pre-applied. Drop-in replacements for upstream modules with enforced security defaults.

51 compliance-ready modules

97 controls

Compliance-Ready Modules

Storage

terraform-aws-modules/efs

aws

2.2.1

Shared file storage with encryption

Enforcesencryption-at-restbackup-policy

Restrictsunencrypted-file-systems

terraform-aws-modules/fsx

aws

1.3.2

High-performance file storage with encryption

Enforcesencryption-at-restautomated-backups

Restrictsunencrypted-file-systems

terraform-aws-modules/s3-bucket

aws

5.16.1

Object storage baseline for any compliance framework

Enforcesencryption-at-restversioningpublic-access-blocking

Restrictspublic-aclsunencrypted-objects

Compute & Containers

terraform-aws-modules/autoscaling

aws

9.3.2

Scalable compute with hardened launch configuration

Enforcesimdsv2-in-launch-templatehealth-check-grace-period

Restrictsimdsv1unencrypted-ebs-in-launch-template

terraform-aws-modules/ec2-instance

aws

6.4.1

Standalone compute with hardened instance metadata

Enforcesimdsv2ebs-encryptiondetailed-monitoring

Restrictsimdsv1unencrypted-root-volumes

terraform-aws-modules/lambda

aws

8.9.0

Serverless compute with audit trail and network isolation

Enforcesvpc-placementx-ray-tracingdead-letter-queue

Restrictspublic-url-auth-typereserved-concurrency-floor

terraform-aws-modules/ecs

aws

7.6.1

Container workloads with audit logging and task isolation

Enforcescloudwatch-loggingtask-role-separationencryption

Restrictsprivileged-containershost-networking

terraform-aws-modules/eks

aws

21.26.0

Container orchestration for regulated workloads

Enforcesenvelope-encryptionaudit-loggingprivate-endpoint

Restrictspublic-endpoint-accessoutdated-kubernetes-versions

terraform-aws-modules/ecr

aws

3.2.1

Container image storage with supply chain security

Enforcesimage-scanning-on-pushimmutable-tagskms-encryption

Restrictsmutable-image-tagsunscanned-images

terraform-aws-modules/app-runner

aws

1.2.3

Managed container service with private network egress

Enforcesno-controls-enforced-yetpofix-processed-with-manifest

terraform-aws-modules/batch

aws

3.1.0

Batch compute with bounded, auditable job definitions

Enforcesno-controls-enforced-yetpofix-processed-with-manifest

terraform-aws-modules/eks-pod-identity

aws

2.9.0

Per-workload AWS credentials on EKS without node-role sharing

Enforcesno-controls-enforced-yetpofix-processed-with-manifest

terraform-aws-modules/key-pair

aws

3.0.1

SSH key material provisioning for EC2 fleets

Enforcesno-controls-enforced-yetpofix-processed-with-manifest

Networking & Edge

terraform-aws-modules/alb

aws

10.5.1

Load balancing with encryption in transit and access trails

Enforcesaccess-loggingtls-1.2https-redirect

Restrictshttp-only-listenersweak-tls-policies

terraform-aws-modules/cloudfront

aws

6.7.1

Edge delivery with encryption in transit

Enforceshttps-onlytls-1.2-minimumaccess-logging

Restrictshttp-protocolweak-tls-versions

terraform-aws-modules/elb

aws

4.0.3

Legacy load balancing with access trails

Enforcesaccess-loggingssl-certificates

Restrictshttp-only-listenersweak-ssl-policies

terraform-aws-modules/network-firewall

aws

2.1.0

Network segmentation and deep packet inspection

Enforcesstateful-inspectionflow-loggingalert-mode

Restrictsdisabled-loggingpass-all-rules

terraform-aws-modules/vpc

aws

6.7.3

Network foundation for SOC 2 and PCI DSS workloads

Enforcesflow-logsdns-hostnamesprivate-subnet-isolation

Restrictsdefault-security-group-rulespublic-subnet-auto-assign-ip

terraform-aws-modules/vpn-gateway

aws

4.0.0

Hybrid connectivity with encrypted tunnels

Enforcesikev2-encryptiontunnel-logging

Restrictsweak-encryption-algorithms

terraform-aws-modules/wafv2

aws

2.1.0

Web application firewall for SOC 2 and PCI DSS workloads

Enforcescloudwatch-metrics-on-rule-groupsrequest-loggingmanaged-rules

Restrictsunmonitored-rulespermissive-default-actions

terraform-aws-modules/security-group

aws

6.0.0

Network boundary control where every open port must be justified

Enforcesauthorized-ports-on-ingress-rules-open-to-0.0.0.0/0-or-::/0

Restrictsunrestricted-ingress-on-unauthorized-portsexposed-cassandra-ports

terraform-aws-modules/customer-gateway

aws

3.1.2

Site-to-site VPN endpoint definition

Enforcesno-controls-enforced-yetpofix-processed-with-manifest

terraform-aws-modules/global-accelerator

aws

3.0.1

Anycast entry point in front of regional endpoints

Enforcesno-controls-enforced-yetpofix-processed-with-manifest

terraform-aws-modules/route53

aws

6.5.1

DNS zone management with query-log evidence

Enforcesauthorized-ingress-ports-on-resolver-endpoint-security-group-rules-open-to-0.0.0.0/0-or-::/0

Restrictsworld-open-resolver-endpoint-ingress-on-unauthorized-ports

terraform-aws-modules/transit-gateway

aws

3.3.1

Multi-VPC and multi-account network segmentation

Enforcesmanual-approval-for-cross-account-attachments

Restrictsauto-accepted-cross-account-attachments

Databases, Caching & Analytics

terraform-aws-modules/dms

aws

2.6.2

Database migration with encrypted transport

Enforcesencryption-in-transitencrypted-storage

Restrictspublic-replication-instances

terraform-aws-modules/dynamodb-table

aws

5.5.2

NoSQL storage with compliance-ready defaults

Enforcesencryption-at-restpoint-in-time-recoverydeletion-protection

Restrictsunencrypted-tablesdisabled-backups

terraform-aws-modules/elasticache

aws

1.11.1

In-memory caching with encrypted transport

Enforcesencryption-in-transitauth-tokenautomatic-failover

Restrictsunencrypted-connectionssingle-az

terraform-aws-modules/opensearch

aws

2.11.1

Search and analytics with network isolation

Enforcesencryption-at-restnode-to-node-encryptionaudit-logs

Restrictspublic-accessdisabled-encryption

terraform-aws-modules/rds

aws

7.2.2

PCI DSS and HIPAA database baseline

Enforcesencryption-at-restautomated-backupsaudit-logging

Restrictspublic-accessweak-engine-versions

terraform-aws-modules/rds-aurora

aws

10.4.1

High-availability databases for PCI DSS and HIPAA

Enforcesstorage-encryptionautomated-backupsaudit-logging

Restrictspublic-accessunencrypted-storage

terraform-aws-modules/redshift

aws

7.1.1

Data warehouse with compliance-ready defaults

Enforcesencryptionaudit-loggingenhanced-vpc-routing

Restrictspublic-accessdisabled-logging

terraform-aws-modules/emr

aws

3.3.0

Big data processing with encryption baseline

Enforcesat-rest-encryptionin-transit-encryptionlogging

Restrictsdisabled-encryptionpublic-master-node

terraform-aws-modules/memory-db

aws

3.2.0

In-memory datastore with authenticated access control

Enforcesno-controls-enforced-yetpofix-processed-with-manifest

terraform-aws-modules/rds-proxy

aws

4.4.1

Connection pooling and secret-brokered database auth

Enforces365-day-cloudwatch-log-retentionlog-group-encryption-at-rest

Restrictsunencrypted-or-short-retention-proxy-logs

Security, Keys & Configuration

terraform-aws-modules/acm

aws

6.3.1

TLS certificate automation

Enforcesdns-validationcertificate-transparency-logging

Restrictsemail-validation

terraform-aws-modules/kms

aws

4.2.2

Encryption key management foundation

Enforcesautomatic-key-rotationrestrictive-key-policy

Restrictsdisabled-rotationoverly-permissive-key-policies

terraform-aws-modules/secrets-manager

aws

2.1.1

Secrets lifecycle management with encryption

Enforceskms-encryptionrotation-scheduleresource-policy

Restrictsunencrypted-secretsdisabled-rotation

terraform-aws-modules/ssm-parameter

aws

2.1.2

Configuration management with encrypted storage

Enforceskms-encryption-for-securestring

Restrictsunencrypted-securestring-parameters

terraform-aws-modules/iam

aws

6.8.2

Least-privilege role and policy baselines across accounts

Enforcesaccount-password-policy:-14-character-minimumupper/lower/number/symbol90-day-expiry24-password-reuse-history

Restrictsweakshort-livedor-reusable-console-passwords

terraform-aws-modules/appconfig

aws

2.0.2

Progressive configuration rollout with rollback

Enforcesno-controls-enforced-yetpofix-processed-with-manifest

Messaging & Streaming

terraform-aws-modules/msk-kafka-cluster

aws

3.3.1

Event streaming with mTLS and audit trails

Enforcestls-encryptionclient-authenticationbroker-logging

Restrictsplaintext-connectionsunauthenticated-access

terraform-aws-modules/sns

aws

7.1.1

Event notification with encryption

Enforceskms-encryptiontopic-policy

Restrictsunencrypted-topics

terraform-aws-modules/sqs

aws

5.2.2

Message queuing with encrypted transport

Enforceskms-encryptiondlq-configuration

Restrictsunencrypted-queues

API & Application Integration

terraform-aws-modules/apigateway-v2

aws

6.1.1

API endpoints with auth and audit logging

Enforcesaccess-loggingthrottlingjwt-authorizer

Restrictsunauthenticated-routesdisabled-logging

terraform-aws-modules/appsync

aws

4.1.1

GraphQL APIs with auth and audit logging

Enforcescloudwatch-loggingauthentication-required

Restrictsapi-key-only-authdisabled-logging

terraform-aws-modules/step-functions

aws

5.1.1

Workflow orchestration with audit trails

Enforcesexecution-loggingx-ray-tracing

Restrictsdisabled-logging

terraform-aws-modules/eventbridge

aws

4.3.2

Event-driven integration with archived, replayable delivery

Enforcesno-controls-enforced-yetpofix-processed-with-manifest

Observability

terraform-aws-modules/cloudwatch

aws

5.7.3

Observability foundation with compliant log retention

Enforceslog-retention-periodkms-encryption

Restrictsindefinite-retentionunencrypted-log-groups

terraform-aws-modules/managed-service-grafana

aws

2.3.2

Dashboarding with federated, non-local authentication

Enforcesno-controls-enforced-yetpofix-processed-with-manifest

terraform-aws-modules/managed-service-prometheus

aws

4.3.1

Metrics retention and alerting for regulated workloads

Enforces365-day-cloudwatch-log-retentionlog-group-encryption-at-rest

Restrictsunencrypted-or-short-retention-workspace-logs