Question 1

What does the ComplyRim IaC Compliance Validator do?

Accepted Answer

It scans Terraform and CloudFormation (including CDK output) before you deploy and maps every result to control IDs in SOC 2, the HIPAA Security Rule, FedRAMP Moderate and CMMC 2.0 Level 2. Each control is recorded as SATISFIED, VIOLATED, PARTIAL, WAIVED or NOT ASSESSED, and every scan produces a SHA-256-digested evidence package: an executive PDF, a full PDF, a JSON export, a findings CSV and a manifest. It runs as an AMI appliance inside your own AWS VPC and is sold on AWS Marketplace.

Question 2

Does the IaC Compliance Validator replace checkov?

Accepted Answer

No. It runs the open-source checkov engine underneath, and its findings match raw checkov exactly. What it adds is the layer auditors ask for: a signed crosswalk from each check to framework control IDs, a control-state register that includes NOT ASSESSED, coverage and pass rate reported separately, waivers with separation of duties, a hash-chained audit log and a digested evidence package. Free scanners tell you which checks failed; auditors ask which control that supports and where the evidence is.

Question 3

What do coverage and pass rate mean, and why are they separate?

Accepted Answer

Coverage is the share of a framework's controls that infrastructure code can evidence at all. Pass rate is the share of those covered controls that currently pass. The Validator reports both per framework and never blends them into one score, because a single score can look high by checking little. A check that was never evaluated, such as a parse error or a skipped check, is never counted as a pass. Controls that need runtime, organizational or physical evidence are listed as NOT ASSESSED so you know what to evidence elsewhere.

Question 4

Is the evidence package a certification?

Accepted Answer

No. The report states its own scope: evidence about declared IaC configuration, not a certification, attestation or audit opinion. It proves what the code declares at the commit that was scanned, not what is running in the account. ComplyRim Readiness Snapshot reads the AWS account as deployed, so teams typically pair the two: the Validator's NOT ASSESSED register is, in practice, the runtime list that CRS covers.

Question 5

Does any IaC or evidence leave my VPC?

Accepted Answer

No IaC or evidence leaves your VPC. The appliance reads source text only and never connects to your AWS account. It launches from a CloudFormation template (a Terraform module is also provided) into a private subnet with no public IP, IMDSv2 and no SSH; admin access is through AWS Systems Manager. The only outbound requirement is a route to AWS License Manager, through a NAT gateway or VPC endpoint, for the licence check.

Question 6

Which plans include FedRAMP Moderate and CMMC 2.0 Level 2?

Accepted Answer

Basic is $800 per month and scores SOC 2 and HIPAA, with 50 scans, 3 users, a 30-day audit log and deployment in us-east-1 or us-west-2. Standard is $1,500 per month and adds FedRAMP Moderate and CMMC 2.0 Level 2, with 250 scans and 10 users. Professional is $3,000 per month with all four frameworks and unlimited scans and users. All plans bill through AWS Marketplace and the buyer pays EC2 and EBS separately. Need a free trial? Request a private offer at aws@complyrim.com.

Scanners list failed checks. Auditors ask which control and where the evidence is. The Validator answers both before you deploy.

What Sets the IaC Compliance Validator Apart on AWS Marketplace

Control-Level Crosswalk: Every Finding Mapped to a Control ID

SHA-256-Digested Evidence Package: Reproducible Artifacts for Your Auditor

Your VPC, Your Data: An AMI Appliance, Not a SaaS Tenant

Scanners Report Checks. Auditors Ask About Controls.

Pre-Deploy Compliance Evidence for Terraform and CloudFormation

Three Plans. One Evidence Package Format.

$800

Stop Discovering Control Gaps in the Audit Room

Ready to Start Your Compliance Journey?