Terraform Catalog
Open-source Terraform modules with compliance built in
Getting to SOC2, HIPAA, or FedRAMP usually takes months of infrastructure work. Our modules build these controls in from the start:
- Encryption at rest and in transit
- Audit logging
- Fine-grained access controls
- Network security best practices
- Data protection and privacy controls
- Integration with compliance tools like Vanta and Drata
Why Use opsZero Modules
Spend your time on your product, not on infrastructure configuration.
Open Source
Licensed under LGPLv3. Use, study, and modify the modules to fit your needs.
Continuously Updated
We keep the modules current with new cloud features, security patches, and best practices.
Easy to Adapt
Clear documentation and straightforward implementations make the modules easy to understand, adapt, and troubleshoot.
Explore Our Terraform Module Catalog
Production-ready infrastructure modules.
| Module | Description |
|---|---|
| terraform-aws-airflow ↗ | Deploy Apache Airflow workflow orchestration on AWS EKS. |
| terraform-aws-aurora ↗ | Provision AWS Aurora RDS clusters with compliance-ready security settings. |
| terraform-aws-bitbucket-oidc ↗ | Configure OIDC trust between Bitbucket Pipelines and AWS for keyless deployments. |
| terraform-aws-cloudflare-security-group ↗ | Create AWS security groups allowing traffic from Cloudflare IP ranges. |
| terraform-aws-cloudwatch-to-s3-archiver ↗ | Archive AWS CloudWatch logs to S3 for long-term retention. |
| terraform-aws-compliance-hub ↗ | Enable AWS Security Hub and compliance standards for SOC2, HIPAA, and PCI. |
| terraform-aws-documentdb ↗ | Provision AWS DocumentDB (MongoDB-compatible) clusters with secure defaults. |
| terraform-aws-ecr ↗ | Create and manage AWS Elastic Container Registry repositories. |
| terraform-aws-eks-airbyte ↗ | Deploy Airbyte data integration platform on AWS EKS. |
| terraform-aws-eks-efs ↗ | Provision AWS EFS storage as a persistent volume on EKS. |
| terraform-aws-eks-mageai ↗ | Deploy Mage AI data pipeline orchestration on AWS EKS. |
| terraform-aws-eks-metabase ↗ | Deploy Metabase business intelligence tool on AWS EKS. |
| terraform-aws-eks-n8n ↗ | Deploy n8n workflow automation platform on AWS EKS. |
| terraform-aws-elasticache ↗ | Provision AWS ElastiCache Redis or Memcached clusters with secure defaults. |
| terraform-aws-elb-cloudwatch ↗ | Set up CloudWatch alarms and dashboards for AWS Elastic Load Balancers. |
| terraform-aws-github-security-group ↗ | Create AWS security groups allowing traffic from GitHub Actions IP ranges. |
| terraform-aws-iam ↗ | Manage AWS IAM users, groups, roles, and policies with MFA enforcement. |
| terraform-aws-iam-identity-center ↗ | Configure AWS IAM Identity Center (SSO) with permission sets and account assignments. |
| terraform-aws-instance ↗ | Provision AWS EC2 instances with secure defaults and compliance-ready settings. |
| terraform-aws-kubespot ↗ | Compliance-ready Kubernetes on AWS EKS with SOC2 and HIPAA support. |
| terraform-aws-memorydb ↗ | Provision AWS MemoryDB for Redis with high availability and compliance settings. |
| terraform-aws-mongodbatlas ↗ | Provision MongoDB Atlas clusters with AWS private endpoint integration. |
| terraform-aws-oidc-github ↗ | Configure OIDC trust between GitHub Actions and AWS for keyless deployments. |
| terraform-aws-oidc-gitlab ↗ | Configure OIDC trust between GitLab CI and AWS for keyless deployments. |
| terraform-aws-opensearch ↗ | Provision AWS OpenSearch clusters with fine-grained access control and encryption. |
| terraform-aws-rds ↗ | Provision AWS RDS databases with encryption, backups, and compliance settings. |
| terraform-aws-rds-cross-region-backup ↗ | Automate cross-region backups of AWS RDS snapshots for disaster recovery. |
| terraform-aws-redshift-serverless ↗ | Provision AWS Redshift Serverless namespaces and workgroups. |
| terraform-aws-s3 ↗ | Terraform module to create a default S3 bucket with logging and custom encryption settings. |
| terraform-aws-security-group ↗ | Create reusable AWS security groups with standard ingress and egress rules. |
| terraform-aws-sqs ↗ | Create AWS SQS queues with encryption and dead-letter queue support. |
| terraform-aws-ssm ↗ | Manage AWS Systems Manager Parameter Store secrets and session manager access. |
| terraform-aws-subnets ↗ | Create public and private subnets across AWS availability zones. |
| terraform-aws-vpc ↗ | Provision a production-ready AWS VPC with subnets, routing, and NAT gateways. |
| terraform-aws-workspaces ↗ | Provision AWS WorkSpaces virtual desktops with directory and security configuration. |
| terraform-azure-postgresql ↗ | Provision Azure Database for PostgreSQL with secure defaults. |
| terraform-azuread-mrmgr ↗ | Manage Azure Active Directory service principals and federated identity credentials. |
| terraform-azurerm-acs ↗ | Provision Azure Communication Services for email and SMS integration. |
| terraform-azurerm-entra-id ↗ | Manage Azure Entra ID users, groups, roles, and conditional access policies. |
| terraform-azurerm-flexible-postgresql ↗ | Provision Azure Flexible Server PostgreSQL with compliance-ready configuration. |
| terraform-azurerm-kubespot ↗ | Compliance-ready Kubernetes on Azure AKS with SOC2 and HIPAA support. |
| terraform-azurerm-subnet ↗ | Create and manage Azure virtual network subnets with service endpoint support. |
| terraform-azurerm-vnet ↗ | Provision Azure Virtual Networks with configurable address spaces and DNS settings. |
| terraform-azurerm-vnet-peering ↗ | Establish VNet peering between Azure Virtual Networks across regions. |
| terraform-cloudflare-domain ↗ | Manage Cloudflare DNS records, zones, and domain security settings. |
| terraform-datadog-helm-kubespot ↗ | Deploy and configure Datadog monitoring agent on Kubespot Kubernetes clusters. |
| terraform-github-mrmgr ↗ | Manage GitHub organization teams, repositories, and member permissions. |
| terraform-google-iam ↗ | Manages multiple IAM roles for resources on Google Cloud. |
| terraform-google-kubespot ↗ | Compliance-ready Kubernetes on Google Cloud GKE with SOC2 and HIPAA support. |
| terraform-google-mrmgr ↗ | Manage Google Cloud IAM service accounts and workload identity federation. |
| terraform-helm-aws-vault ↗ | Deploy HashiCorp Vault secrets manager on Kubernetes. |
| terraform-helm-celery-exporter ↗ | Deploy Celery metrics exporter for monitoring task queues on Kubernetes. |
| terraform-helm-kubespot ↗ | Deploy core opsZero Kubespot platform services on Kubernetes. |
| terraform-helm-meilisearch ↗ | Deploy Meilisearch fast search engine on Kubernetes. |
| terraform-helm-openreplay ↗ | Deploy OpenReplay session replay and analytics on Kubernetes. |
| terraform-helm-opentelemetry ↗ | Deploy OpenTelemetry collector for distributed tracing on Kubernetes. |
| terraform-helm-spicedb-operator ↗ | Deploy SpiceDB operator for fine-grained authorization on Kubernetes. |
| terraform-helm-splunk ↗ | Deploy Splunk log aggregation and monitoring on Kubernetes. |
| terraform-kubernetes-airflow ↗ | Deploy Apache Airflow workflow orchestration on Kubernetes. |
| terraform-kubernetes-socat ↗ | Deploy socat TCP proxy as a Kubernetes service for port forwarding. |
| terraform-template ↗ | Terraform module template with opsZero standard structure and compliance defaults. |
Why Choose opsZero’s Terraform Catalog?
See how our modules compare to building it yourself or using generic modules.
Is the Terraform Catalog compliance-ready?
Yes. Compliance-ready architecture for SOC2, HIPAA, and similar frameworks is built in. Building it yourself requires significant expertise, and generic modules usually provide basic security only.
How long does deployment take?
Days with the Terraform Catalog, compared with months when building it yourself and weeks with generic modules.
What support is available?
The modules are free and open source. opsZero also offers enterprise support with dedicated expert assistance. Building it yourself means self-support only, and generic modules rely on community forums.
Does it integrate with audit tools?
Yes. The modules are pre-configured for Vanta, Drata, and similar tools. Building it yourself requires custom integration, and generic modules offer limited or no integration.
Does it work across clouds?
Yes. The modules are standardized across AWS, GCP, and Azure. Building it yourself varies by implementation, and generic modules are often provider-specific.
How are security updates handled?
The modules are continuously maintained. Building it yourself requires tracking updates manually, and generic modules update on variable schedules.
What is the total cost of ownership?
Low, compared with very high when building it yourself and medium with generic modules.