gtcx-ecosystem/terraform-aws-compliance-db

Compliance-ready dual-database infrastructure for regulated African fintech. Dual PostgreSQL + KYC storage + 7-year backup. FATF-compliant. # terraform-aws-compliance-db Compliance-ready dual-database infrastructure for regulated African fintech. Deploys a dual PostgreSQL architecture (operational + append-only audit) with FATF-compliant KYC document storage, automated backups with 7-year Glacier retention, and encryption everywhere. ## What it creates - **Operational Database** (RDS PostgreSQL) — read/write, auto-scaling storage, Multi-AZ optional - **Audit Database** (RDS PostgreSQL) — append-only, deletion protection always enabled, extended backup retention - **KYC Document Storage** (S3) — presigned URL access, KMS encryption, FATF-minimum 5-year retention, Glacier lifecycle - **Backup Export** (Lambda + EventBridge) — monthly snapshot export to S3 with 7-year retention - All resources encrypted at rest via KMS with auto-rotation ## Quick start ```hcl module "compliance_db" { source = "./modules/compliance-db" environment = "zimbabwe-pilot" jurisdiction = "zimbabwe" region = "af-south-1" vpc_id = module.vpc.vpc_id subnet_ids = module.vpc.database_subnet_ids eks_oidc_provider_arn = module.eks.oidc_provider_arn eks_oidc_provider_url = module.eks.oidc_provider_url allowed_security_groups = [module.eks.node_security_group_id] } ``` ## Jurisdiction presets ### Phase 1 — Big 8 (~85% of African fintech volume) | Jurisdiction | Region | KYC Retention | Audit Retention | Regulator | Data Protection Law | | -------------- | ---------- | -------------- | --------------- | --------- | ------------------------------------------- | | `zimbabwe` | af-south-1 | 1825 days (5y) | 2555 days (7y) | RBZ | Cyber and Data Protection Act (2021) | | `south_africa` | af-south-1 | 1825 days (5y) | 2555 days (7y) | SARB | POPIA (2013) | | `nigeria` | af-south-1 | 2190 days (6y) | 2555 days (7y) | CBN | NDPA (2023) | | `egypt` | me-south-1 | 1825 days (5y) | 3650 days …