Infrastructure-as-Code Compliance Evidence
The IaC Compliance Validator scans Terraform and CloudFormation (including CDK output) inside your own AWS VPC and maps every finding to control IDs in SOC 2, HIPAA, FedRAMP Moderate, and CMMC 2.0 Level 2. Every scan ships a signed evidence package: executive PDF, full report, JSON, findings CSV, and a SHA-256 manifest. Deployed as an AMI in your VPC. From $800/mo on AWS Marketplace.
AWS Marketplace
Terraform + CloudFormation
4 Frameworks Mapped
Signed Evidence Package
AWS MARKETPLACE HIGHLIGHTS
A scanner tells you a check failed. The Validator tells you which control it supports: SOC 2 (TSC 2017), HIPAA Security Rule (45 CFR 164 Subpart C), FedRAMP Moderate (NIST 800-53 Rev 5), or CMMC 2.0 Level 2 (NIST 800-171 Rev 2). Coverage and pass rate are reported separately, never blended, and an unevaluated check is never counted as passed.
Each scan produces an executive PDF, a full report, a JSON export, a findings CSV, and a manifest with SHA-256 digests plus a detached signature. It is reproducible evidence about your declared IaC configuration, not a certification.
The Validator runs as an AMI inside your own VPC. It reads source text only and sends nothing to ComplyRim. Your Terraform, CloudFormation, and evidence packages never leave your network.
THE PROBLEM
Open-source scanners such as checkov flag misconfigurations in your Terraform and CloudFormation. That is useful, but a pass/fail list is not audit evidence. When the auditor asks which SOC 2 or CMMC control a finding supports, and where the signed, dated proof is, the pipeline has nothing to hand over.
WITHOUT THE VALIDATOR
WITH THE VALIDATOR
KEY CAPABILITIES
Everything you need to turn an IaC scan into control-mapped evidence.
Terraform + CloudFormation
Scans .tf files and CloudFormation templates directly, including the cdk.out output of CDK projects. No agent, no sidecar, no change to your pipeline.
Four-Framework Crosswalk
SOC 2, HIPAA, FedRAMP Moderate, and CMMC 2.0 Level 2 control IDs on every finding. CMMC leads coverage at 36.5% of controls addressed.
Signed Evidence Package
Executive PDF, full report, JSON, findings CSV, and a SHA-256 manifest with detached signature. Coverage % and pass rate % reported separately.
AMI in Your VPC
Launch from AWS Marketplace into an existing subnet. Reads source text only. No egress, no SaaS tenant.
Pairs with CRS
CRS reads your deployed AWS account at runtime. The Validator reads IaC before deploy. Together they cover both layers of evidence.
AWS Marketplace
Subscribe through AWS Marketplace and apply your existing AWS credits. No new vendor relationship.
PRICING
Pick the frameworks and regions you need. Subscribe through AWS Marketplace and apply existing credits.
/ month
Basic plan. SOC 2 + HIPAA, us-east-1 and us-west-2
✓
Standard $1,500/mo and Professional $3,000/mo: all four frameworks, multi-region
✓
Signed evidence package on every plan: executive PDF, full report, JSON, CSV, SHA-256 manifest
✓
Control crosswalk for SOC 2, HIPAA, FedRAMP Moderate, CMMC 2.0 L2
✓
AMI in your own VPC. No egress, nothing sent to ComplyRim
✓
Billed through your AWS account. Apply existing credits
No free trial. Subscribe on AWS Marketplace and cancel before the next billing cycle if it is not a fit.
Scan your IaC before you deploy and hand your auditor a signed, control-mapped evidence package, generated inside your own VPC.
