efsterraform-aws-modules/efs/aws 2.2.1

Shared file storage with encryption

Enforces

encryption at rest, backup policy

Restricts

unencrypted file systems

fsxterraform-aws-modules/fsx/aws 1.3.2

High-performance file storage with encryption

Enforces

encryption at rest, automated backups

Restricts

unencrypted file systems

s3-bucketterraform-aws-modules/s3-bucket/aws 5.16.2

Object storage baseline for any compliance framework

Enforces

encryption at rest, versioning, public access blocking

Restricts

public ACLs, unencrypted objects

app-runnerterraform-aws-modules/app-runner/aws 1.2.3

Managed container service with private network egress

autoscalingterraform-aws-modules/autoscaling/aws 9.3.2

Scalable compute with hardened launch configuration

Enforces

IMDSv2 in launch template, health check grace period

Restricts

IMDSv1, unencrypted EBS in launch template

batchterraform-aws-modules/batch/aws 3.1.0

Batch compute with bounded, auditable job definitions

ec2-instanceterraform-aws-modules/ec2-instance/aws 6.4.1

Standalone compute with hardened instance metadata

Enforces

IMDSv2, EBS encryption, detailed monitoring

Restricts

IMDSv1, unencrypted root volumes

ecrterraform-aws-modules/ecr/aws 3.2.1

Container image storage with supply chain security

Enforces

image scanning on push, immutable tags, KMS encryption

Restricts

mutable image tags, unscanned images

ecsterraform-aws-modules/ecs/aws 7.6.1

Container workloads with audit logging and task isolation

Enforces

CloudWatch logging, task role separation, encryption

Restricts

privileged containers, host networking

eks-pod-identityterraform-aws-modules/eks-pod-identity/aws 2.10.0

Per-workload AWS credentials on EKS without node-role sharing

eksterraform-aws-modules/eks/aws 21.29.0

Container orchestration for regulated workloads

Enforces

envelope encryption, audit logging, private endpoint

Restricts

public endpoint access, outdated Kubernetes versions

key-pairterraform-aws-modules/key-pair/aws 3.0.1

SSH key material provisioning for EC2 fleets

lambdaterraform-aws-modules/lambda/aws 8.13.0

Serverless compute with audit trail and network isolation

Enforces

VPC placement, X-Ray tracing, dead letter queue

Restricts

public URL auth type, reserved concurrency floor

albterraform-aws-modules/alb/aws 10.5.1

Load balancing with encryption in transit and access trails

Enforces

access logging, TLS 1.2, HTTPS redirect

Restricts

HTTP-only listeners, weak TLS policies

cloudfrontterraform-aws-modules/cloudfront/aws 6.7.1

Edge delivery with encryption in transit

Enforces

HTTPS-only, TLS 1.2 minimum, access logging

Restricts

HTTP protocol, weak TLS versions

customer-gatewayterraform-aws-modules/customer-gateway/aws 3.1.2

Site-to-site VPN endpoint definition

elbterraform-aws-modules/elb/aws 4.0.3

Legacy load balancing with access trails

Enforces

access logging, SSL certificates

Restricts

HTTP-only listeners, weak SSL policies

global-acceleratorterraform-aws-modules/global-accelerator/aws 3.0.1

Anycast entry point in front of regional endpoints

network-firewallterraform-aws-modules/network-firewall/aws 2.1.0

Network segmentation and deep packet inspection

Enforces

stateful inspection, flow logging, alert mode

Restricts

disabled logging, pass-all rules

route53terraform-aws-modules/route53/aws 6.5.1

DNS zone management with query-log evidence

Enforces

authorized ingress ports on resolver-endpoint security group rules open to 0.0.0.0/0 or ::/0

Restricts

world-open resolver endpoint ingress on unauthorized ports

security-groupterraform-aws-modules/security-group/aws 6.0.0

Network boundary control where every open port must be justified

Enforces

authorized ports on ingress rules open to 0.0.0.0/0 or ::/0

Restricts

unrestricted ingress on unauthorized ports, exposed Cassandra ports

transit-gatewayterraform-aws-modules/transit-gateway/aws 3.3.1

Multi-VPC and multi-account network segmentation

Enforces

manual approval for cross-account attachments

Restricts

auto-accepted cross-account attachments

vpcterraform-aws-modules/vpc/aws 6.7.3

Network foundation for SOC 2 and PCI DSS workloads

Enforces

flow logs, DNS hostnames, private subnet isolation

Restricts

default security group rules, public subnet auto-assign IP

vpn-gatewayterraform-aws-modules/vpn-gateway/aws 4.0.0

Hybrid connectivity with encrypted tunnels

Enforces

IKEv2 encryption, tunnel logging

Restricts

weak encryption algorithms

wafv2terraform-aws-modules/wafv2/aws 2.1.0

Web application firewall for SOC 2 and PCI DSS workloads

Enforces

CloudWatch metrics on rule groups, request logging, managed rules

Restricts

unmonitored rules, permissive default actions

dmsterraform-aws-modules/dms/aws 2.6.2

Database migration with encrypted transport

Enforces

encryption in transit, encrypted storage

Restricts

public replication instances

dynamodb-tableterraform-aws-modules/dynamodb-table/aws 5.5.2

NoSQL storage with compliance-ready defaults

Enforces

encryption at rest, point-in-time recovery, deletion protection

Restricts

unencrypted tables, disabled backups

elasticacheterraform-aws-modules/elasticache/aws 1.11.2

In-memory caching with encrypted transport

Enforces

encryption in transit, auth token, automatic failover

Restricts

unencrypted connections, single-AZ

emrterraform-aws-modules/emr/aws 3.3.0

Big data processing with encryption baseline

Enforces

at-rest encryption, in-transit encryption, logging

Restricts

disabled encryption, public master node

memory-dbterraform-aws-modules/memory-db/aws 3.2.0

In-memory datastore with authenticated access control

opensearchterraform-aws-modules/opensearch/aws 2.11.1

Search and analytics with network isolation

Enforces

encryption at rest, node-to-node encryption, audit logs

Restricts

public access, disabled encryption

rds-auroraterraform-aws-modules/rds-aurora/aws 10.4.2

High-availability databases for PCI DSS and HIPAA

Enforces

storage encryption, automated backups, audit logging

Restricts

public access, unencrypted storage

rds-proxyterraform-aws-modules/rds-proxy/aws 4.4.1

Connection pooling and secret-brokered database auth

Enforces

365-day CloudWatch log retention, log group encryption at rest

Restricts

unencrypted or short-retention proxy logs

rdsterraform-aws-modules/rds/aws 7.2.2

PCI DSS and HIPAA database baseline

Enforces

encryption at rest, automated backups, audit logging

Restricts

public access, weak engine versions

redshiftterraform-aws-modules/redshift/aws 7.1.1

Data warehouse with compliance-ready defaults

Enforces

encryption, audit logging, enhanced VPC routing

Restricts

public access, disabled logging

acmterraform-aws-modules/acm/aws 6.3.1

TLS certificate automation

Enforces

DNS validation, certificate transparency logging

Restricts

email validation

appconfigterraform-aws-modules/appconfig/aws 2.0.2

Progressive configuration rollout with rollback

iamterraform-aws-modules/iam/aws 6.8.2

Least-privilege role and policy baselines across accounts

Enforces

account password policy: 14-character minimum, upper/lower/number/symbol, 90-day expiry, 24-password reuse history

Restricts

weak, short-lived, or reusable console passwords

kmsterraform-aws-modules/kms/aws 4.2.2

Encryption key management foundation

Enforces

automatic key rotation, restrictive key policy

Restricts

disabled rotation, overly permissive key policies

secrets-managerterraform-aws-modules/secrets-manager/aws 2.2.0

Secrets lifecycle management with encryption

Enforces

KMS encryption, rotation schedule, resource policy

Restricts

unencrypted secrets, disabled rotation

ssm-parameterterraform-aws-modules/ssm-parameter/aws 2.1.2

Configuration management with encrypted storage

Enforces

KMS encryption for SecureString

Restricts

unencrypted SecureString parameters

msk-kafka-clusterterraform-aws-modules/msk-kafka-cluster/aws 3.3.1

Event streaming with mTLS and audit trails

Enforces

TLS encryption, client authentication, broker logging

Restricts

plaintext connections, unauthenticated access

snsterraform-aws-modules/sns/aws 7.2.0

Event notification with encryption

Enforces

KMS encryption, topic policy

Restricts

unencrypted topics

sqsterraform-aws-modules/sqs/aws 5.2.2

Message queuing with encrypted transport

Enforces

KMS encryption, DLQ configuration

Restricts

unencrypted queues

apigateway-v2terraform-aws-modules/apigateway-v2/aws 6.1.1

API endpoints with auth and audit logging

Enforces

access logging, throttling, JWT authorizer

Restricts

unauthenticated routes, disabled logging

appsyncterraform-aws-modules/appsync/aws 4.1.1

GraphQL APIs with auth and audit logging

Enforces

CloudWatch logging, authentication required

Restricts

API key-only auth, disabled logging

eventbridgeterraform-aws-modules/eventbridge/aws 4.3.3

Event-driven integration with archived, replayable delivery

step-functionsterraform-aws-modules/step-functions/aws 5.1.1

Workflow orchestration with audit trails

Enforces

execution logging, X-Ray tracing

Restricts

disabled logging

cloudwatchterraform-aws-modules/cloudwatch/aws 6.0.0

Observability foundation with compliant log retention

Enforces

log retention period, KMS encryption

Restricts

indefinite retention, unencrypted log groups

managed-service-grafanaterraform-aws-modules/managed-service-grafana/aws 2.3.2

Dashboarding with federated, non-local authentication

managed-service-prometheusterraform-aws-modules/managed-service-prometheus/aws 4.3.1

Metrics retention and alerting for regulated workloads

Enforces

365-day CloudWatch log retention, log group encryption at rest

Restricts

unencrypted or short-retention workspace logs