---
title: "Greenfield Generation"
description: "Generate compliant Terraform modules from scratch for new infrastructure."
---

import { Aside } from '@astrojs/starlight/components';

Starting a new cloud project? Generate Terraform modules that are compliant from day one.

## Initialize a compliant project

Run `complyform init` to scaffold a Terraform module that satisfies your target frameworks.

```bash
complyform init --cloud=gcp --frameworks=soc2,hipaa
```

This generates a complete Terraform module directory:

```
complyform-output/
├── main.tf                    # Compliant resource definitions
├── variables.tf               # Input variables with secure defaults
├── outputs.tf                 # Standard outputs
├── terraform.tfvars.example   # Example variable values
├── README.md                  # Module documentation
└── modules/
    ├── compute/
    ├── storage/
    └── database/
```

Every resource definition includes the configuration required by the selected frameworks — encryption keys, IAM bindings, logging, network restrictions.

## Select specific services

By default, `init` generates resources for all supported services. Narrow the scope with `--services`:

```bash
complyform init --cloud=gcp --frameworks=soc2 --services=compute,storage,database
```

Available service groups vary by cloud provider. Run `complyform init --cloud=gcp --help` to list them.

## Multi-framework generation

When you specify multiple frameworks, ComplyForm takes the union of all control requirements. If SOC 2 requires encryption at rest and HIPAA requires audit logging, the generated module includes both. No controls are dropped.

```bash
complyform init --cloud=aws --frameworks=soc2,hipaa,iso27001
```

## Customize the output

Generated files are standard Terraform — modify them freely. Add your own resources, adjust variable defaults, integrate with existing modules. The generated code is yours.

After making changes, re-check compliance:

```bash
complyform assess --frameworks=soc2,hipaa
```

This catches any regressions introduced by your edits.

<Aside type="tip">
Run `complyform validate` on your modified configs to catch compliance regressions before `terraform apply`.
</Aside>

## Example: GCP project with SOC 2 and HIPAA

```bash
# Generate the module
complyform init --cloud=gcp --frameworks=soc2,hipaa --services=compute,database

# Review generated resources
ls complyform-output/

# Customize, then validate
cd complyform-output
complyform validate

# Deploy
terraform init
terraform plan
terraform apply
```

## Next steps

- [`complyform init`](../../cli-reference/init/) — full init options and service groups
- [`complyform validate`](../../cli-reference/validate/) — pre-deploy compliance checks
- [Brownfield Assessment](../brownfield/) — assess existing infrastructure
