FedRAMP 20x with Terraform
Terraform is a generator for intended state. 20x cares whether the running system matches that state and whether change happens by redeploy (KSI-CMT), not whether a `.tf` file exists in a gist.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
Plan/apply logs, state hashes, and policy-as-code (OPA/Sentinel) can be replayable methods when they cover the in-scope resources. Two applies of the same root module are not two independent methods.
How to implement
Pin module versions. Record the workspace-to-boundary map in the SDR. Pair Terraform with the CI/CD and cloud pages — IaC without a pipeline is still a manual change process.
Common mistakes
- Hot-patching in the console and 'refreshing' state to hide drift. - Calling terraform fmt a KSI validation method.
Related hub pages
Primary sources
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
- Security Decision Record (retrieved 2026-09-27)
- FedRAMP Certification reference (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.