Terraform AWS Compliance Framework

Overview

A suite of production-grade, open-source Terraform modules engineered to evaluate and enforce security compliance across hybrid on-premises environments, Kubernetes nodes, and source control repositories using native AWS governance services—without deploying external Lambda overhead.

The framework leverages AWS Systems Manager (SSM) State Manager associations, AWS Config custom Guard 2.x policy rules, and Amazon EventBridge to deliver continuous posture reporting.

• GitHub Modules:
  • terraform-aws-onprem-kubernetes-compliance
  • terraform-aws-onprem-server-compliance
  • terraform-aws-github-repo-compliance

Architectural Highlights

• Zero-Lambda Evaluation: Uses SSM Association compliance reporting coupled with AWS Config Guard 2.x domain-specific rules, eliminating cold starts, runtime maintenance, and Lambda VPC attachment overhead.
• Hybrid CIS Kubernetes Auditing: Automatically installs and executes verified releases of kube-bench across managed Linux nodes (amd64 / arm64), evaluates API server version drift, and verifies static pod audit logging policies.
• Automated Patch Audits: Onboards bare-metal and virtual machine nodes as hybrid managed instances, schedules Patch Manager scans, and feeds compliance state to AWS Config.
• Repository Governance: Continuously audits GitHub repositories for mandatory branch protections, review requirements, private visibility, and disabled public forking.
• Event-Driven Alerting: Seamlessly integrates with AWS EventBridge rules and SNS topics for immediate SecOps notifications upon rule violations.