Skip to content
ComplyForm Docs

Brownfield Assessment

You have existing Terraform resources deployed. Here’s how to assess and fix compliance gaps without disrupting your infrastructure.

Step 1 — Scan existing resources

Section titled “Step 1 — Scan existing resources”

Point complyform scan at your state file to discover deployed resources.

Terminal window
# Local state file
complyform scan --state=terraform.tfstate


# Remote state (GCS)
complyform scan --state=gs://my-org-tfstate/prod/default.tfstate


# Multiple state files
complyform scan --state=terraform.tfstate --state=gs://bucket/staging.tfstate

Use --output=json if you need machine-readable output for CI pipelines.

Step 2 — Assess compliance posture

Section titled “Step 2 — Assess compliance posture”

Run an assessment against one or more frameworks.

Terminal window
# Single framework
complyform assess --frameworks=soc2


# Multiple frameworks (union of controls)
complyform assess --frameworks=soc2,hipaa,iso27001

Example output:

Assessment: SOC 2 Type II
Resources scanned:  142
Controls evaluated: 87
  Passed:           61  (70.1%)
  Failed:           22  (25.3%)
  Not applicable:    4  ( 4.6%)
Compliance score:   70.1%

Step 3 — Review the gap report

Section titled “Step 3 — Review the gap report”

Failed controls produce a gap report with actionable detail.

FAIL  CC6.1.3  google_sql_database_instance.production
  Severity:     CRITICAL
  Description:  Cloud SQL instance lacks customer-managed encryption key
  Remediation:  Add `encryption_key_name` to disk_encryption_configuration block


FAIL  CC6.6.1  google_compute_firewall.allow_all
  Severity:     HIGH
  Description:  Firewall rule allows ingress from 0.0.0.0/0
  Remediation:  Restrict source_ranges to specific CIDR blocks

Pipe to JSON for integration with other tools: complyform assess --frameworks=soc2 --output=json.

Step 4 — Prioritize by severity

Section titled “Step 4 — Prioritize by severity”

Filter findings to focus on what matters first.

Terminal window
complyform assess --frameworks=soc2 --severity=critical,high

Work through findings in order: critical → high → medium → low. Critical findings typically represent data exposure or missing encryption — fix these before your next audit window.

Step 5 — Generate remediation patches

Section titled “Step 5 — Generate remediation patches”

Let ComplyForm generate Terraform patch files for failed controls.

Terminal window
complyform remediate --frameworks=soc2

This produces .tf patch files in a remediation/ directory. Patches are additive — they add missing configuration blocks and arguments without modifying your existing resource definitions. Always review patches before running terraform apply.

Step 6 — Validate patches

Section titled “Step 6 — Validate patches”

Confirm the patches resolve compliance gaps.

Terminal window
complyform validate

This runs Checkov against the patched configuration and reports any remaining failures.

Next steps

Section titled “Next steps”