Compliance

BetterCF can be initialised in one of three modes. You specify your mode during the bettercf init CLI call by adding --mode standard/governance/compliance. By default, standard mode is used.

Standard Mode

Little to no protection for your templates. You are to own your own security, via IAM policies.

Governance Mode

There is an added layer of protection, restricting AWS users from being able to delete/alter an existing template unless they have the s3:BypassGovernanceRetention IAM action allowed.

Compliance Mode

Any templates pushed are immutable to all AWS users for 10 years. There is no way to delete or alter those templates. Use this mode with caution.