Module reference
Every published module in one table, grouped by the cloud it targets. Use it to answer the question a library index actually gets asked: do you cover the thing I run, and what has been proven about it.
Reading the two columns
Functional is whether the current version was really applied to a cloud account, asserted against, and destroyed with the teardown confirmed. Anything short of that reads Static-validated, which is what every published module clears at minimum.
What a blank is not
No policy applies means the scanner has no rules for that provider. It is absence of coverage, not a clean result, so it is never counted as a pass. A finding is printed in red on the module that has it rather than left out to keep the column tidy.
183 modules
| Module | Category | Tool | Version | Functional | Security scan |
|---|---|---|---|---|---|
| AWS39 | |||||
| aws-acmRequests a public, DNS-validated ACM TLS certificate that ACM auto-renews forever, outputting the validation records to publish - CT logging on, wildcards and SANs supported. | Secrets & KMS | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-apigateway-httpHTTP API with routes, Lambda/ALB integrations, custom domain, JWT authorizers, and access logs. | API Gateway | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-apigateway-restA REST API wired end to end - resource tree built from route paths, deny-by-default IAM authorization, MOCK/Lambda/HTTP integrations, deployment + stage with throttling and JSON access logs. | API Gateway | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-s3-bucketPrivate S3 bucket with encryption, versioning, public-access block, and TLS-only policy. | Storage | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-albALB with HTTPS listeners, target groups, listener rules, and access logging - drop-in for ECS/EC2/Lambda targets. | Load Balancing | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-auroraAurora PostgreSQL/MySQL cluster with instances, parameter groups, Serverless v2 scaling, and enhanced monitoring. | Databases | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-cloudfront-siteComplete HTTPS site/CDN: CloudFront distribution, OAC-locked S3 origin, ACM cert, and Route53 alias records. | CDN & Edge | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| aws-cloudwatchA self-contained CloudWatch observability bundle - an encrypted log group with retention, a metric alarm, and a dashboard - that stands up from just a name and points at any real metric. | Observability | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-codedeployCodeDeploy application, deployment groups, and the platform-correct service role for automated EC2/ECS/Lambda rollouts with auto-rollback on failure. | CI/CD & Automation | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-codepipelineAWS-native CI/CD: CodePipeline orchestrating a CodeBuild project, with an encrypted private artifact bucket and least-privilege roles. Sources from S3 (or GitHub). | CI/CD & Automation | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-cognitoA secure-by-default Cognito user pool and app client with optional hosted-UI domain - strong password policy, TOTP MFA, account-enumeration protection, SRP-only flows, and refresh-token revocation. | Security & Identity | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-dynamodb-tableDynamoDB table with GSIs/LSIs, TTL, streams, autoscaling or on-demand, and point-in-time recovery. | Databases | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-ec2-instanceEC2 instance with IMDSv2, encrypted EBS, instance profile, and EIP - secure defaults out of the box. | Compute & VMs | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-autoscalingEC2 launch template and Auto Scaling group with IMDSv2 enforced, encrypted gp3 root volume, an egress-only security group, and scale-to-zero defaults so it applies cleanly with no compute cost. | Compute & VMs | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-ecrECR repo with lifecycle rules, scan-on-push, immutable tags, and cross-account/replication policies. | Container Registry | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-ecs-fargate-serviceFull Fargate stack: cluster, task definition, service with ALB integration, autoscaling, and Cloud Map discovery. | Serverless & Containers | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-efsAn EFS file system with mount targets, a least-privilege NFS security group, lifecycle tiering, automatic backups, and a resource policy that enforces encryption in transit. | Storage | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-eksOpinionated EKS cluster with node groups, core add-ons, Pod Identity, and KMS secret encryption. | Kubernetes | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-elasticache-redisA cluster-mode-disabled ElastiCache Redis/Valkey cache with encryption at rest and in transit both on, no public exposure, and the subnet group and security group created for you. | Databases | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-eventbridgeA custom EventBridge event bus, a pattern-filtered rule, and a target wired end-to-end - encryption at rest always on, least-privilege log delivery, and a 24h retry policy with optional DLQ. | Messaging & Streaming | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-iam-rolesLeast-privilege IAM roles, managed policies, and GitHub/EKS OIDC federation in one composable module. | Security & Identity | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-jenkinsSelf-hosted Jenkins controller on a hardened EC2 instance - restricted security group, IMDSv2 enforced, SSM access, encrypted root volume, Jenkins auto-installed via user-data. | CI/CD & Automation | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-kmsCustomer-managed KMS keys with sane key policies, aliases, rotation, and multi-region replicas. | Secrets & KMS | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-kinesisA Kinesis Data Stream with KMS encryption at rest on by default and ON_DEMAND capacity (no shard math), plus optional enhanced fan-out consumers and IAM-only access. | Messaging & Streaming | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-lambdaLambda with execution role, log group, triggers, aliases, and zip/container packaging handled. | Serverless & Containers | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-mskAn MSK Serverless Apache Kafka cluster with no brokers to size - SASL/IAM authentication only, encryption in transit and at rest always on, multi-AZ placement, and a locked-down security group. | Messaging & Streaming | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-nlbA Layer-4 Network Load Balancer with map-driven TCP/UDP/TLS listeners and target groups, modern TLS 1.3 termination from an ACM cert, and self-contained default-VPC networking. | Load Balancing | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-vpcBattle-tested multi-AZ VPC with public/private/database subnets, NAT, endpoints, and flow logs. | Networking & VPC | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-rdsSingle-instance or Multi-AZ RDS with subnet/parameter/option groups, backups, and monitoring wired correctly. | Databases | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-redshiftA production-ready single-node Redshift cluster with encryption always on, never publicly accessible, a parameter group enforcing require_ssl, and a generated admin password stored in Secrets Manager. | Databases | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-route53A Route 53 hosted zone (public or private via vpc_ids) plus a map-driven set of records, with name normalisation and the alias-vs-rdata distinction resolved and inputs validated. | DNS | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-sesAn SES v2 sending stack - a configuration set with an optional domain/email identity (Easy DKIM) - with TLS required, bounce/complaint suppression, and reputation metrics to CloudWatch. | Messaging & Streaming | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-snsSNS standard/FIFO topic with encryption, delivery policies, and SQS/Lambda/email subscriptions. | Messaging & Streaming | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-sqsSQS standard/FIFO queue with dead-letter queue, redrive policy, SSE, and least-privilege queue policy. | Messaging & Streaming | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-ssm-parameter-storeMap-driven SSM Parameter Store parameters - String, StringList, and SecureString - created from a single map, with SecureString always KMS-encrypted and the free Standard tier by default. | Secrets & KMS | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-secrets-managerSecrets with versioning, resource policies, replication, and optional Lambda rotation scaffolding. | Secrets & KMS | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-security-groupSecurity groups with named rule presets (https, postgres, redis...) using modern standalone rule resources. | Security & Identity | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-step-functionsA Step Functions state machine (STANDARD or EXPRESS) with a least-privilege execution role, a managed CloudWatch log group, X-Ray tracing, and encryption at rest - working out of the box from a single name. | Serverless & Containers | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| aws-wafA WAFv2 web ACL (REGIONAL or CLOUDFRONT) with a default-allow posture, configurable AWS managed rule groups blocking by default, and a rate-based rule that throttles abusive IPs. | Security & Identity | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| Azure37 | |||||
| azure-api-managementAn API Management gateway tuned for the serverless Consumption tier - scale-to-zero, billed per call - with a system-assigned managed identity, TLS hardening, and HTTP/2 enabled. | API Gateway | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-application-gatewayRegional L7 load balancer with WAF v2 policy, TLS termination from Key Vault, autoscaling and health probes. | Load Balancing | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-app-serviceApp Service plan + Linux web app with deployment slots, custom domain + managed TLS, VNet integration and autoscale. | Serverless & Containers | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-bastion-jumpboxBastion (Developer/Basic/Standard SKU) with optional hardened Linux VM, JIT-style NSG rules and boot diagnostics for secure VM access without public IPs. | Security & Identity | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-redis-cacheAzure Cache for Redis done cheap by default - the Basic C0 tier with TLS 1.2 minimum and the non-SSL port disabled - scaling cleanly up to Standard and Premium via precondition-guarded inputs. | Databases | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| azure-container-appsContainer Apps environment with workload profiles, Dapr, KEDA scale rules, ACR pull identity and custom domain. | Serverless & Containers | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| azure-container-instancesRuns one or more containers on Azure Container Instances without VMs or an orchestrator - secure by default with no privileged containers, redacted secret fields, and an optional managed identity. | Serverless & Containers | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-acrACR with geo-replication, retention/trust policies, private endpoint and AcrPull role wiring for AKS/Container Apps. | Container Registry | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-cosmos-dbCosmos DB (NoSQL or MongoDB API) with multi-region failover, autoscale throughput, private endpoint and backup policy. | Databases | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-devopsBootstraps an Azure DevOps project with an initialized Git repository and a YAML build pipeline - repeatable team setup as code. | CI/CD & Automation | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-front-doorGlobal entry point: Front Door profile, endpoints, origin groups, custom domains with managed TLS and WAF policy. | Load Balancing | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| azure-functionsFunction app (Flex Consumption or Premium) with storage, Application Insights, managed identity and VNet integration. | Serverless & Containers | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-key-vaultRBAC-mode Key Vault with private endpoint, diagnostics, and managed keys/secrets/certificates scaffolding. | Secrets & KMS | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-aksHardened AKS with system/user node pools, workload identity, Entra RBAC integration, Azure CNI overlay, and Container Insights wired in. | Kubernetes | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-landing-zone-coreManagement-group hierarchy, policy baseline (ALZ-aligned), centralized logging and RBAC scaffolding - the flagship enterprise starter. | Landing Zones & Foundations | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-vmssA self-contained Linux VM Scale Set (Uniform orchestration) on Azure - one apply creates the resource group, VNet, subnet, NSG and an SSH-key-only scale set with deny-all-inbound and no public IPs. | Compute & VMs | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-virtual-machineA fully self-contained general-purpose Linux VM on Azure - one apply creates the resource group, VNet, subnet, NSG, NIC, optional public IP and an SSH-key-only VM with a system-assigned identity. | Compute & VMs | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-monitor-baselineCentral Log Analytics workspace, diagnostic-settings-everywhere pattern, action groups and starter alert pack (metric + log + activity). | Observability | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| azure-private-dnsA self-contained Azure Private DNS zone with virtual-network links and optional record sets for private name resolution across VNets and Private Endpoints - VM auto-registration off by default. | DNS | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-private-endpointAn Azure Private Endpoint giving a target PaaS resource a private IP inside your VNet so traffic stays on the Microsoft backbone - wire to existing subnet/target or run fully self-contained. | Networking & VPC | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-dns-zoneAn Azure public DNS zone plus a map-driven set of record sets - A, AAAA, CNAME, TXT, MX, NS, CAA and SRV - with relative naming, verbatim TXT values, and apex footgun guards. | DNS | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| azure-sql-databaseLogical SQL server + database with Entra-only auth, firewall/private endpoint, auditing, TDE and failover-group option. | Databases | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-load-balancerAn Azure Standard L4 load balancer with a self-created static public IP frontend, a backend address pool, health probes and load-balancing rules - Standard SKU throughout. | Load Balancing | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| azure-static-web-appGlobally distributed hosting for static sites and SPAs on Azure Static Web Apps with optional serverless APIs, free auto-renewing TLS, and a built-in global CDN - defaulting to the cost-free Free SKU. | Serverless & Containers | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| azure-storage-accountStorage account with containers/file shares, lifecycle rules, network rules, CMK encryption and private endpoint options - Azure's most-deployed resource done right. | Storage | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-traffic-managerGlobal, DNS-based load balancing with a Traffic Manager profile and map-driven external endpoints - Performance, Priority, Weighted, Geographic, Subnet or MultiValue routing with an HTTPS health probe. | Load Balancing | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| azure-vnetProduction VNet with subnets, NSGs, route tables, peering and optional NAT Gateway - the network backbone every Azure deployment starts with. | Networking & VPC | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-entra-id-baselineApp registrations, service principals, groups and federated credentials (OIDC for GitHub/Terraform) - the identity plumbing every Azure org rebuilds by hand. | Security & Identity | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-event-gridAn Event Grid custom topic plus event subscriptions with an optional in-module Storage Queue target - SAS auth off (Entra ID), a system-assigned identity, and HTTPS-only TLS 1.2+ storage. | Messaging & Streaming | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-event-hubsAn Event Hubs namespace plus hubs, each with consumer groups and least-privilege SAS rules for high-throughput (Kafka-compatible) ingestion - TLS 1.2 floor and optional default-deny networking. | Messaging & Streaming | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-jenkinsSelf-hosted Jenkins on a hardened Azure Linux VM - self-contained vnet/subnet/NSG, SSH-key auth only, managed-disk encryption, Jenkins installed via cloud-init. | CI/CD & Automation | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-logic-appAn Azure Logic App (Consumption) workflow with a built-in Recurrence trigger - serverless pay-per-execution automation with a system-assigned managed identity and inbound IP allowlists. | Serverless & Containers | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| azure-mysql-flexibleAzure Database for MySQL Flexible Server with TLS required by default, correct delegated-subnet + private DNS zone ordering, an Entra administrator, databases, and cheapest-by-default Burstable sizing. | Databases | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-postgresql-flexibleFlexible Server with HA option, private VNet delegation, Entra auth, firewall and tuned server parameters. | Databases | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-resource-group-baselineOpinionated resource group factory with CAF-compliant naming, mandatory tags, locks and budget alert. | Other | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| azure-service-busAn Azure Service Bus namespace with queues, topics and subscriptions on the Standard SKU - SAS local auth off (Entra ID + RBAC), TLS 1.2+ minimum, and dead-lettering of expired messages. | Messaging & Streaming | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| azure-managed-identityA map-driven module creating one or many user-assigned managed identities, each with optional workload identity federation (OIDC) and least-privilege RBAC role assignments - no secrets to rotate. | Security & Identity | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| Google Cloud37 | |||||
| gcp-api-gatewayA serverless API Gateway fronting an OpenAPI 2.0 spec - API, immutable config and managed gateway - with a dedicated least-privilege backend service account and a built-in default spec. | API Gateway | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| gcp-alloydbAlloyDB cluster with primary + read-pool instances, PSC connectivity, automated backups and columnar/vector engine flags. | Databases | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-artifact-registryDocker/Maven/npm repos with cleanup policies, remote and virtual repositories, CMEK and reader/writer IAM. | Container Registry | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-bigquery-datasetDatasets with partitioned/clustered tables, authorized views, CMEK and dataset-level access controls. | Databases | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-certificate-managerA Certificate Manager certificate map for external HTTPS load balancers, with an optional Google-managed certificate and DNS authorization provisioned when you supply a domain you control. | Secrets & KMS | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| gcp-cloud-armorA global Cloud Armor WAF policy with preconfigured OWASP SQLi and XSS rules enforcing by default, an optional per-client rate limit, and custom IP allow/deny rules - attachable to many backends. | Security & Identity | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-bigtableA single-cluster Cloud Bigtable instance (one 1-node SSD cluster, the smallest footprint) plus a table with column families, IAM-only access, optional CMEK, and deletion protection on. | Databases | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-composerManaged Apache Airflow on Cloud Composer 2 with small-by-default sizing, worker autoscaling pinned for predictable cost, and an opt-in private environment posture. | CI/CD & Automation | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| gcp-cloud-dnsPublic/private managed zones with record sets, DNSSEC, forwarding and peering configs. | DNS | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-filestoreA managed Cloud Filestore NFS share for GKE and Compute Engine, VPC-peered with no public exposure, optional per-client export rules for least-privilege access, and deletion protection on. | Storage | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| gcp-kmsKeyrings and rotation-enabled crypto keys with per-key IAM for CMEK across GCS, BigQuery, Cloud SQL and disks. | Secrets & KMS | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-monitoringA self-contained observability bundle: a metric-threshold alert policy, a Monitoring dashboard, and a log-export sink to a locked-down GCS bucket with the sink writer-identity IAM grant wired in. | Observability | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| gcp-cloud-natA regional Cloud Router and Cloud NAT gateway giving private, external-IP-less instances outbound internet access, with auto-allocated NAT IPs, all-subnet coverage, and logging on by default. | Networking & VPC | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| gcp-cloud-functionEvent-driven or HTTP gen2 function with source upload, dedicated runtime SA and Eventarc trigger wiring. | Serverless & Containers | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-cloud-run-jobA Cloud Run v2 Job for batch and run-to-completion workloads with a dedicated runtime service account, auto-wired Secret Manager accessor grants, VPC egress, bounded retries and per-task timeout. | Serverless & Containers | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| gcp-cloud-run-serviceCloud Run v2 service with autoscaling, secret and VPC egress wiring, custom domain and invoker IAM done right. | Serverless & Containers | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-cloud-sqlRegional-HA Cloud SQL with private IP (PSA/PSC), automated backups, PITR, read replicas and IAM database auth. | Databases | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-cloud-schedulerA Cloud Scheduler cron job that calls an HTTP(S) endpoint on a schedule, with a bounded attempt deadline, capped exponential-backoff retries, and per-invocation OIDC/OAuth service-account auth. | Messaging & Streaming | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| gcp-spannerA regional Cloud Spanner instance at the smallest billable size (100 processing units) plus a database with optional starter schema, drop protection, and Terraform deletion protection on. | Databases | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-gcs-bucketHardened GCS bucket with uniform access, versioning, lifecycle/soft-delete policies, CMEK and least-privilege IAM. | Storage | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-cloud-tasksA Cloud Tasks queue with capped dispatch rate and concurrency, a bounded exponential-backoff retry policy, and full Stackdriver logging so failed dispatches are observable rather than silent. | Messaging & Streaming | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| gcp-workflowsA Cloud Workflows workflow that runs as a dedicated least-privilege service account instead of the broad Compute Engine default, with inline YAML, deletion protection, and call logging. | CI/CD & Automation | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| gcp-compute-instanceA hardened Compute Engine VM on Debian 12 with Shielded VM (Secure Boot, vTPM, integrity monitoring), OS Login for IAM-managed SSH, no external IP by default, and deletion protection on. | Compute & VMs | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-dataprocA single-node Dataproc cluster (1 master, 0 workers), the cheapest managed Spark/Hadoop cluster that still applies and destroys cleanly, with internal-only IPs and deletion protection on. | CI/CD & Automation | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-eventarcAn Eventarc Pub/Sub trigger wired into a self-contained pipeline - a Cloud Run target, a dedicated delivery service account, and the run.invoker and eventReceiver grants Eventarc silently requires. | Messaging & Streaming | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-project-factoryOpinionated project creation: API enablement, billing budget, default-SA lockdown, audit log sinks and baseline IAM. | Landing Zones & Foundations | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-vpcProduction VPC with subnets, secondary ranges, firewall rules, Cloud Router and Cloud NAT - the network base every GCP workload sits on. | Networking & VPC | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-gke-clusterPrivate, Workload-Identity-enabled GKE cluster with managed node pools, release channels and maintenance windows, hardened to Google best practice. | Kubernetes | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-http-load-balancerGlobal ALB with managed TLS certs, URL map, serverless/instance NEG backends, optional Cloud CDN and Cloud Armor policy. | Load Balancing | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-ha-vpn99.99% SLA HA VPN gateway pair with BGP-dynamic routing - GCP-to-on-prem or GCP-to-AWS/Azure. | Networking & VPC | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-internal-lbAn internal passthrough L4 load balancer - health check, regional backend service and forwarding rule - that stands up before any backends exist, preserving client source IPs, with optional global access. | Load Balancing | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-managed-instance-groupA zonal Managed Instance Group built from a hardened Shielded-VM instance template, private by default, with optional CPU autoscaling, autohealing, and zero-downtime rolling template updates. | Compute & VMs | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-memorystorePrivate Memorystore instance or cluster (Redis or Valkey) with auth, TLS and maintenance policy on your VPC. | Databases | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-pubsubTopics with schemas, push/pull/BigQuery subscriptions, dead-letter queues and retry policies preconfigured. | Messaging & Streaming | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-secret-managerSecrets with versions, replication policy, rotation schedules, expiry and accessor IAM. | Secrets & KMS | Terraform | v1.1.0 | ✓ Live-tested | No policy applies |
| gcp-service-accounts-iamService accounts with least-privilege project/resource IAM and optional Workload Identity Federation for keyless CI/CD (GitHub Actions). | Security & Identity | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| gcp-vertex-aiA Vertex AI Endpoint for online prediction with optional CMEK, optional Private Service Access networking and request/response logging - model deployment left to you, so it stands up for cents. | AI & ML | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| Oracle Cloud18 | |||||
| oci-api-gatewayManaged API gateway with route deployments, JWT/auth policies, rate limiting, CORS and custom-domain TLS. | API Gateway | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| oci-autonomous-databaseATP/ADW/JSON/APEX autonomous database with private endpoint, mTLS wallet output, ACLs, auto-scaling and backup config. | Databases | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| oci-base-databaseOracle Database VM system with DB home, TDE via Vault, automated backups and optional Data Guard standby. | Databases | Terraform | v1.1.0 | Static-validated | Failed |
| oci-bastionZero-footprint managed bastion with session-managed SSH/port-forward access to private subnets - replaces jump hosts. | Security & Identity | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| oci-dns-zonePublic/private DNS zones with record sets, failover/geo steering policies and health-check probes. | DNS | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| oci-drg-hubDynamic Routing Gateway with VCN attachments, custom DRG route tables, remote peering and IPSec/FastConnect attach points. | Networking & VPC | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| oci-file-storageElastic NFSv3 file system with mount target, export options, snapshots and NSG-scoped access. | Storage | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| oci-load-balancerHTTPS load balancer with backend sets, health checks, TLS certificates, rule sets and WAF-ready listeners. | Load Balancing | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| oci-functions-appServerless Fn application with functions, provisioned concurrency, invoke logging and Events-rule trigger wiring. | Serverless & Containers | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| oci-instance-pool-autoscalingSelf-healing instance pool from an instance configuration with metric- or schedule-based autoscaling and LB attachment. | Compute & VMs | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| oci-mysql-heatwaveManaged MySQL with optional HeatWave analytics cluster, HA, backups, configuration and inbound replication channel. | Databases | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| oci-compute-instanceOpinionated VM with E5/A1 flex shapes, cloud-init, attached block volumes, NSGs and in-transit encryption. | Compute & VMs | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| oci-iam-foundationTenancy landing-zone core: compartment hierarchy, groups, dynamic groups, policy statements and tag namespaces from a single map. | Landing Zones & Foundations | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| oci-network-load-balancerLow-latency pass-through NLB with TCP/UDP listeners, backend health checks and preserved client IPs. | Load Balancing | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| oci-vcnProduction VCN with public/private subnets, internet/NAT/service gateways, route tables, NSGs and IPv6 - the module every OCI tenancy starts with. | Networking & VPC | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| oci-okeEnhanced OKE cluster with managed + virtual node pools, private API endpoint, NSGs, addons and OIDC - flagship OCI workload platform. | Kubernetes | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| oci-object-storage-bucketBucket with versioning, lifecycle/auto-tiering, retention rules, replication and pre-authenticated request support. | Storage | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| oci-vault-kmsKMS vault with HSM/software master keys, key rotation and secret lifecycle management for app credentials. | Secrets & KMS | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| Linode9 | |||||
| linode-volumeAttachable, resizable NVMe block volume with safe attach/detach lifecycle handling. | Storage | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| linode-firewallOpinionated stateful firewall with deny-by-default inbound, curated allow rules, and multi-device attachment. | Security & Identity | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| linode-instanceHardened Linode VM with cloud-init, disk encryption, reverse DNS, backups, and firewall attachment in one apply. | Compute & VMs | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| linode-domainComplete DNS zone with typed record management and sane TTL defaults on Linode's free DNS Manager. | DNS | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| linode-lke-clusterProduction LKE cluster with autoscaling node pools, HA control plane, disk encryption, ACL, and optional Enterprise tier. | Kubernetes | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| linode-databaseHA managed database cluster with allowlists, maintenance windows, and fork/restore support on the new Aiven platform. | Databases | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| linode-nodebalancerManaged L4/L7 load balancer with TLS termination, health checks, session stickiness, and UDP support. | Load Balancing | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| linode-object-storageS3-compatible bucket with scoped access keys, versioning, lifecycle rules, and optional static-site hosting. | Storage | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| linode-vpcIsolated VPC network with labeled subnets ready for instances, LKE, and NodeBalancer backends. | Networking & VPC | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| Akamai8 | |||||
| akamai-appsec-wafSecurity configuration with policy, WAF mode, match targets, rate controls, and IP/geo blocking, activated to staging or production. | Security & Identity | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| akamai-cps-dv-certificateAutomated Domain Validated TLS enrollment with DNS/HTTP challenge outputs wired for Edge DNS. | Secrets & KMS | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| akamai-edge-dns-zoneAuthoritative Edge DNS zone with full recordset management on Akamai's DDoS-resilient anycast network. | DNS | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| akamai-cloudlets-edge-redirectorRule-driven edge redirects (vanity URLs, migrations) managed as code with versioned policy activation. | CDN & Edge | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| akamai-edgeworkerDeploy JavaScript at the edge with bundle versioning, EdgeKV namespace, and network activation in one module. | Serverless & Containers | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| akamai-gtm-failoverGlobal Traffic Management domain with datacenters and failover or weighted-round-robin properties plus liveness tests. | DNS | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| akamai-property-ionEnd-to-end Ion CDN property: origin, edge hostname, caching/performance rule tree, CP code, and staging/production activation. | CDN & Edge | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| akamai-network-listsVersioned IP and geo block/allow lists with activation, ready to feed WAF policies and property rules. | Security & Identity | Terraform | v1.1.0 | ✓ Live-tested | ✓ Passed |
| DigitalOcean4 | |||||
| do-app-platformDeclarative App Platform deployment with services, workers, domains, and alerts. | Serverless & Containers | Terraform | v1.1.0 | Static-validated | No policy applies |
| do-doks-clusterProduction DOKS with node pools, VPC, registry hookup, and maintenance windows in one apply. | Kubernetes | Terraform | v1.1.0 | Static-validated | No policy applies |
| do-droplet-stackHardened droplet(s) with VPC, firewall, volume, reserved IP, and cloud-init bootstrap. | Compute & VMs | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| do-managed-databaseManaged PG/MySQL/Valkey cluster with firewall trust list, users, DBs, and replicas. | Databases | Terraform | v1.1.0 | Static-validated | No policy applies |
| Cloudflare3 | |||||
| cloudflare-dnsZone DNS records, security settings, and managed WAF rulesets for a Cloudflare zone - provider v5 ready. | DNS | Terraform | v1.1.0 | Static-validated | No policy applies |
| cloudflare-workers-platformWorker with KV/R2/D1 bindings, routes, custom domain, and secrets - full edge app scaffold. | Serverless & Containers | Terraform | v1.1.0 | Static-validated | No policy applies |
| cloudflare-zero-trust-accessAccess application with policies, identity provider wiring, and a cloudflared tunnel to private origins. | Security & Identity | Terraform | v1.1.0 | Static-validated | No policy applies |
| Hetzner3 | |||||
| hetzner-lb-web-tierManaged LB with health checks, cert, and label-selected server targets. | Load Balancing | Terraform | v1.1.0 | Static-validated | No policy applies |
| hetzner-private-networkPrivate network with subnets, routes, and a NAT gateway server for egress-only fleets. | Networking & VPC | Terraform | v1.1.0 | Static-validated | No policy applies |
| hetzner-server-fleetN-server fleet with placement group, firewall, primary IPs, and cloud-init - Hetzner's price/perf with guardrails. | Compute & VMs | Terraform | v1.1.0 | Static-validated | No policy applies |
| Scaleway3 | |||||
| scaleway-kapsule-clusterKapsule Kubernetes with pools, private network, and autoscaling/autoheal presets. | Kubernetes | Terraform | v1.1.0 | Static-validated | No policy applies |
| scaleway-rdb-instanceRDB PostgreSQL/MySQL with HA, private-network endpoint, users, and ACLs. | Databases | Terraform | v1.1.0 | Static-validated | No policy applies |
| scaleway-serverless-containerContainer namespace, deployed container, custom domain, and registry wiring. | Serverless & Containers | Terraform | v1.1.0 | Static-validated | No policy applies |
| Alibaba Cloud2 | |||||
| alicloud-ack-clusterManaged ACK Kubernetes with node pools, VPC integration, and RAM roles. | Kubernetes | Terraform | v1.1.0 | Static-validated | No policy applies |
| alicloud-vpc-foundationMulti-AZ VPC with vSwitches, NAT gateway, SNAT, security groups, and flow logs. | Networking & VPC | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| Civo2 | |||||
| civo-compute-stackInstances with network, firewall, volume, and reserved IP. | Compute & VMs | Terraform | v1.1.0 | Static-validated | No policy applies |
| civo-k3s-clusterFast-launch k3s cluster with node pools, firewall rules, and network. | Kubernetes | Terraform | v1.1.0 | Static-validated | No policy applies |
| Exoscale2 | |||||
| exoscale-dbaasManaged PG/MySQL/Kafka with IP filters and TF-managed users. | Databases | Terraform | v1.1.0 | Static-validated | No policy applies |
| exoscale-sks-clusterSKS Kubernetes with node pools, security groups, and anti-affinity. | Kubernetes | Terraform | v1.1.0 | Static-validated | No policy applies |
| IBM Cloud2 | |||||
| ibm-iks-clusterIKS cluster on VPC Gen2 with worker pools and COS-backed registry namespace. | Kubernetes | Terraform | v1.1.0 | Static-validated | No policy applies |
| ibm-vpc-landingVPC with subnets, public gateways, ACLs, and security groups following IBM SLZ patterns. | Networking & VPC | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| OVHcloud2 | |||||
| ovh-managed-databaseManaged PG/MySQL/Kafka with users, IP restrictions, and private network egress. | Databases | Terraform | v1.1.0 | Static-validated | No policy applies |
| ovh-managed-k8sMKS cluster with node pools and private-network (vRack) attachment. | Kubernetes | Terraform | v1.1.0 | Static-validated | No policy applies |
| Tencent Cloud2 | |||||
| tencent-vpc-foundationVPC with subnets, route tables, NAT, and security groups across AZs. | Networking & VPC | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| tencent-tke-clusterManaged TKE Kubernetes with node pools and VPC-CNI networking. | Kubernetes | Terraform | v1.1.0 | Static-validated | ✓ Passed |
| UpCloud2 | |||||
| upcloud-managed-databaseManaged PG/MySQL with properties tuning, users, and logical DBs. | Databases | Terraform | v1.1.0 | Static-validated | No policy applies |
| upcloud-server-stackServers on SDN private network with storage, router, and firewall rules. | Compute & VMs | Terraform | v1.1.0 | Static-validated | No policy applies |
| Vultr2 | |||||
| vultr-compute-stackInstances with VPC, firewall, block storage, and reserved IP. | Compute & VMs | Terraform | v1.1.0 | Static-validated | No policy applies |
| vultr-vke-clusterVKE Kubernetes with node pools, VPC, and firewall in one module. | Kubernetes | Terraform | v1.1.0 | Static-validated | No policy applies |
| Huawei Cloud1 | |||||
| huawei-cce-clusterCCE Kubernetes with VPC/subnet, node pool, and EIP-attached ingress. | Kubernetes | Terraform | v1.1.0 | Static-validated | No policy applies |
| Multi-cloud & platform-agnostic5 | |||||
| ansible-base-hardeningSSH hardening drop-in, sysctl security profile, login banner, and time sync. Original, live-tested (Molecule) role. | Security & Identity | Ansible | v1.1.0 | ✓ Live-tested | No policy applies |
| ansible-nginxVerified wrapper around geerlingguy.nginx pinned at 3.3.0 plus an IaC Bazaar hardening overlay (server_tokens off, security headers, default-vhost removal); live-tested for idempotence and functionally verified: systemd unit active, HTTP 200, headers present, no version leak. | Web & App Servers | Ansible | v1.1.0 | ✓ Live-tested | No policy applies |
| ansible-postgresqlPostgreSQL server with guarded initdb, SCRAM-SHA-256 auth, managed conf.d drop-in, templated pg_hba, and app database + owner provisioning. Original, live-tested (Molecule/podman) role. | Databases | Ansible | v1.1.0 | ✓ Live-tested | No policy applies |
| ansible-node-exporterOfficial node_exporter release (pinned v1.11.1) with sha256 checksum-verified install, dedicated shell-less system user, and a systemd unit on :9100; live-tested for idempotence with a functional /metrics verification. | Observability | Ansible | v1.1.0 | ✓ Live-tested | No policy applies |
| vault-policiesVault policies, auth backends, and secret engine configuration as code. | Secrets & KMS | Terraform | v1.1.0 | Static-validated | No policy applies |
What is on the module page
Follow any row for the full record: the verification receipts for that release, the published SHA-256 and its cosign signature, the provider versions it was tested against, and the compatibility panel. The declared input and output contract and the source itself need an account.