PCI DSS v4.0 Registry

Compliance-ready Terraform modules with PCI DSS v4.0 controls pre-applied. Drop-in replacements for upstream modules with enforced security defaults.

36 compliance-ready modules

79 controls

Compliance-Ready Modules

Storage

terraform-aws-modules/efs

aws

2.2.0

Shared file storage with encryption

Enforcesencryption-at-restbackup-policy

Restrictsunencrypted-file-systems

terraform-aws-modules/fsx

aws

1.3.1

High-performance file storage with encryption

Enforcesencryption-at-restautomated-backups

Restrictsunencrypted-file-systems

terraform-aws-modules/s3-bucket

aws

5.14.0

Object storage baseline for any compliance framework

Enforcesencryption-at-restversioningpublic-access-blocking

Restrictspublic-aclsunencrypted-objects

Compute & Containers

terraform-aws-modules/autoscaling

aws

9.2.1

Scalable compute with hardened launch configuration

Enforcesimdsv2-in-launch-templatehealth-check-grace-period

Restrictsimdsv1unencrypted-ebs-in-launch-template

terraform-aws-modules/ec2-instance

aws

6.4.0

Standalone compute with hardened instance metadata

Enforcesimdsv2ebs-encryptiondetailed-monitoring

Restrictsimdsv1unencrypted-root-volumes

terraform-aws-modules/lambda

aws

8.8.0

Serverless compute with audit trail and network isolation

Enforcesvpc-placementx-ray-tracingdead-letter-queue

Restrictspublic-url-auth-typereserved-concurrency-floor

terraform-aws-modules/ecs

aws

7.5.0

Container workloads with audit logging and task isolation

Enforcescloudwatch-loggingtask-role-separationencryption

Restrictsprivileged-containershost-networking

terraform-aws-modules/eks

aws

21.23.0

Container orchestration for regulated workloads

Enforcesenvelope-encryptionaudit-loggingprivate-endpoint

Restrictspublic-endpoint-accessoutdated-kubernetes-versions

terraform-aws-modules/ecr

aws

3.2.0

Container image storage with supply chain security

Enforcesimage-scanning-on-pushimmutable-tagskms-encryption

Restrictsmutable-image-tagsunscanned-images

Networking & Edge

terraform-aws-modules/alb

aws

10.5.0

Load balancing with encryption in transit and access trails

Enforcesaccess-loggingtls-1.2https-redirect

Restrictshttp-only-listenersweak-tls-policies

terraform-aws-modules/cloudfront

aws

6.7.0

Edge delivery with encryption in transit

Enforceshttps-onlytls-1.2-minimumaccess-logging

Restrictshttp-protocolweak-tls-versions

terraform-aws-modules/elb

aws

4.0.2

Legacy load balancing with access trails

Enforcesaccess-loggingssl-certificates

Restrictshttp-only-listenersweak-ssl-policies

terraform-aws-modules/network-firewall

aws

2.1.0

Network segmentation and deep packet inspection

Enforcesstateful-inspectionflow-loggingalert-mode

Restrictsdisabled-loggingpass-all-rules

terraform-aws-modules/vpc

aws

6.6.1

Network foundation for SOC 2 and PCI DSS workloads

Enforcesflow-logsdns-hostnamesprivate-subnet-isolation

Restrictsdefault-security-group-rulespublic-subnet-auto-assign-ip

terraform-aws-modules/vpn-gateway

aws

4.0.0

Hybrid connectivity with encrypted tunnels

Enforcesikev2-encryptiontunnel-logging

Restrictsweak-encryption-algorithms

terraform-aws-modules/wafv2

aws

2.1.0

Web application firewall for SOC 2 and PCI DSS workloads

Enforcescloudwatch-metrics-on-rule-groupsrequest-loggingmanaged-rules

Restrictsunmonitored-rulespermissive-default-actions

Databases, Caching & Analytics

terraform-aws-modules/dms

aws

2.6.1

Database migration with encrypted transport

Enforcesencryption-in-transitencrypted-storage

Restrictspublic-replication-instances

terraform-aws-modules/dynamodb-table

aws

5.5.0

NoSQL storage with compliance-ready defaults

Enforcesencryption-at-restpoint-in-time-recoverydeletion-protection

Restrictsunencrypted-tablesdisabled-backups

terraform-aws-modules/elasticache

aws

1.11.0

In-memory caching with encrypted transport

Enforcesencryption-in-transitauth-tokenautomatic-failover

Restrictsunencrypted-connectionssingle-az

terraform-aws-modules/opensearch

aws

2.9.0

Search and analytics with network isolation

Enforcesencryption-at-restnode-to-node-encryptionaudit-logs

Restrictspublic-accessdisabled-encryption

terraform-aws-modules/rds

aws

7.2.0

PCI DSS and HIPAA database baseline

Enforcesencryption-at-restautomated-backupsaudit-logging

Restrictspublic-accessweak-engine-versions

terraform-aws-modules/rds-aurora

aws

10.2.0

High-availability databases for PCI DSS and HIPAA

Enforcesstorage-encryptionautomated-backupsaudit-logging

Restrictspublic-accessunencrypted-storage

terraform-aws-modules/redshift

aws

7.1.0

Data warehouse with compliance-ready defaults

Enforcesencryptionaudit-loggingenhanced-vpc-routing

Restrictspublic-accessdisabled-logging

terraform-aws-modules/emr

aws

3.3.0

Big data processing with encryption baseline

Enforcesat-rest-encryptionin-transit-encryptionlogging

Restrictsdisabled-encryptionpublic-master-node

Security, Keys & Configuration

terraform-aws-modules/acm

aws

6.3.0

TLS certificate automation

Enforcesdns-validationcertificate-transparency-logging

Restrictsemail-validation

terraform-aws-modules/kms

aws

4.2.0

Encryption key management foundation

Enforcesautomatic-key-rotationrestrictive-key-policy

Restrictsdisabled-rotationoverly-permissive-key-policies

terraform-aws-modules/secrets-manager

aws

2.1.0

Secrets lifecycle management with encryption

Enforceskms-encryptionrotation-scheduleresource-policy

Restrictsunencrypted-secretsdisabled-rotation

terraform-aws-modules/ssm-parameter

aws

2.1.0

Configuration management with encrypted storage

Enforceskms-encryption-for-securestring

Restrictsunencrypted-securestring-parameters

Messaging & Streaming

terraform-aws-modules/msk-kafka-cluster

aws

3.3.0

Event streaming with mTLS and audit trails

Enforcestls-encryptionclient-authenticationbroker-logging

Restrictsplaintext-connectionsunauthenticated-access

terraform-aws-modules/sns

aws

7.1.0

Event notification with encryption

Enforceskms-encryptiontopic-policy

Restrictsunencrypted-topics

terraform-aws-modules/sqs

aws

5.2.2

Message queuing with encrypted transport

Enforceskms-encryptiondlq-configuration

Restrictsunencrypted-queues

API & Application Integration

terraform-aws-modules/apigateway-v2

aws

6.1.0

API endpoints with auth and audit logging

Enforcesaccess-loggingthrottlingjwt-authorizer

Restrictsunauthenticated-routesdisabled-logging

terraform-aws-modules/appsync

aws

4.1.0

GraphQL APIs with auth and audit logging

Enforcescloudwatch-loggingauthentication-required

Restrictsapi-key-only-authdisabled-logging

terraform-aws-modules/step-functions

aws

5.1.0

Workflow orchestration with audit trails

Enforcesexecution-loggingx-ray-tracing

Restrictsdisabled-logging

Observability

terraform-aws-modules/cloudwatch

aws

5.7.2

Observability foundation with compliant log retention

Enforceslog-retention-periodkms-encryption

Restrictsindefinite-retentionunencrypted-log-groups