FIPS 140-3 Compliance at Speed with Terraform

FIPS 140-3 is the latest U.S. government standard for validating cryptographic modules. It replaces FIPS 140-2, tightening requirements for algorithm selection, key management, and testing under real-world attack conditions. For teams running workloads in AWS, Azure, or GCP, enabling FIPS-approved algorithms is no longer optional if you handle sensitive or regulated data.

Terraform, as an Infrastructure as Code tool, gives you the repeatability and audit trails needed for compliance. But achieving FIPS 140-3 with Terraform requires more than a few variable tweaks. You must control your cryptographic boundaries from the first resource declaration to the deployed runtime.

Core steps to reach FIPS 140-3 with Terraform:

1. Use FIPS-validated OS images
   Select cloud-provided or custom images configured with FIPS-approved crypto libraries like OpenSSL built in FIPS mode. Reference these images directly in your Terraform aws_instance, azurerm_virtual_machine, or google_compute_instance resources.
2. Pin providers to secure versions
   Maintain provider versions supporting FIPS-compliant authentication flows. Update .terraform.lock.hcl frequently to enforce immutable builds.
3. Enable FIPS mode in managed services
   For AWS, set fips endpoints in your provider configuration:

provider "aws"{
 region = "us-east-1"
 s3_use_accelerate_endpoint = false
 use_fips_endpoint = true
}

Apply equivalent FIPS parameters in Azure and GCP Terraform providers.

1. Automate compliance checks
   Integrate compliance-as-code with tools like AWS Config, Azure Policy, or GCP Forseti enforced through Terraform modules. Validate crypto settings in CI before plan/apply.
2. Document and version every change
   FIPS audits require proof. Terraform state files and Git history become part of your compliance artifacts.

Meeting FIPS 140-3 in Terraform is not just about flipping a switch. It is about enforcing cryptographic discipline across infrastructure, deployment pipelines, and runtime environments.

Running AI agents against production? hoop.dev is an open-source proxy that sits between agents and your databases and servers. It checks every command at runtime and masks sensitive data before it reaches the agent. Try it free: hoop.dev/start