By the Cycloid Platform Engineering team, practitioners building and operating enterprise IDPs since 2015.

Last updated: Q1 2026 – Refreshed with Cycloid vs Spacelift vs Atlantis comparison and SOC 2 / ISO 27001 setup guidance.

A Terraform CI/CD tool with audit logs automates infrastructure provisioning through a pipeline while maintaining a tamper-proof record of every plan, apply, and destroy operation – who triggered it, when, and what changed. This audit trail is required for SOC 2, ISO 27001, and CIS benchmark compliance.

Terraform CI/CD pipelines generate infrastructure changes at scale, but without native audit logs, compliance teams have no visibility into who ran what, when, and what changed. This guide covers what a Terraform CI/CD tool with audit logs is, how platforms compare (Cycloid, Spacelift, Atlantis, HCP Terraform), how to configure audit logging in Cycloid, and which compliance frameworks require it.

Terraform CI/CD with Audit Logs: 4 Platforms Compared

Four platforms cover most of the Terraform CI/CD evaluation shortlist in 2026. They occupy different points on the OSS-versus-managed spectrum, and their audit logging capabilities vary sharply.

The honest read: Atlantis wins on cost (free) and simplicity but requires the team to build the audit layer themselves. HCP Terraform (formerly Terraform Cloud) is the HashiCorp-native default with strong audit on paid plans. Spacelift is the leading multi-IaC platform with deep policy-as-code. Cycloid wins when the audit log is one requirement inside a broader platform engineering purchase – IDP, FinOps, and multi-cloud governance from the same vendor.

Why Terraform Needs Audit Logs (and Why the CLI Alone Is Not Enough)

Terraform CLI on its own produces two artefacts: local state files and stdout logs. Neither satisfies a SOC 2 or ISO 27001 auditor.

What the auditor needs, and what native Terraform does not provide out of the box:

• User attribution. Which engineer or service account triggered the plan and apply. Terraform CLI is happy to be invoked with no identity trail.
• Tamper-proof storage. Logs must be write-once, immutable, and stored somewhere the pipeline user cannot alter. Stdout in CI is trivially tamperable.
• Retention policy. SOC 2 typically requires one year minimum; ISO 27001 recommends three. Native Terraform has no retention concept.
• Query interface. Auditors ask “show me every apply against the production database in Q3.” Grep-ing CI job logs is not a defensible answer.
• Approval and policy evidence. If a change went out, the log should show which policy passed and who approved. Terraform CLI does not know about approvals.

Every gap above is solvable with a wrapper. Building that wrapper is the work most regulated organisations end up doing when they start with Atlantis or the raw CLI. A Terraform CI/CD tool with native audit logging is the pre-built version of that wrapper.

Cycloid: Audit Logs Built into the Pipeline

Cycloid’s Terraform CI/CD runs on Concourse-based pipelines with audit logging enabled by default. Every plan, apply, and destroy operation produces a structured log entry containing user, timestamp, resource changes, policy evaluation result, and pipeline run ID. Logs are stored in the Cycloid platform, queryable through the UI, and exportable to any SIEM via API or JSON webhook.

The integration matters more than the log format. Because audit logging is part of the same platform as StackForms self-service provisioning, Stacks (reusable IaC templates), and InfraView real-time infrastructure visibility, an audit query can join the operation log to the resource state, the policy that gated it, and the cost estimate that ran pre-deploy. That is the difference between a log line and audit evidence.

Compliance Use Cases: SOC 2, ISO 27001, and CIS Benchmarks

SOC 2 Type II – Change Management (CC8.1)

SOC 2 Type II requires continuous evidence of change control operating effectiveness across the reporting period. The auditor typically asks for a sample of production infrastructure changes and expects to see, for each: who initiated it, what approval was recorded, what testing preceded it, and when it went live. Terraform audit logs are the primary evidence source. Set retention to 12 months minimum to cover the full Type II reporting window.

ISO 27001:2022 – Change Management (Annex A.8.32)

ISO 27001:2022 (which replaced the 2013 version and reorganised the Annex A structure) requires change management records under Annex A.8.32. The auditor evaluates whether the organisation has defined, controlled, and documented all changes to information systems. Terraform pipeline audit logs demonstrate this for infrastructure changes; combined with policy-as-code evaluation records, they show that the change was assessed against defined criteria before deployment.

CIS Benchmarks – Infrastructure Change Logging

CIS Benchmarks for AWS, Azure, and GCP each include controls requiring change logging on infrastructure resources. For Terraform-managed environments, the pipeline log is the source of truth for “who changed what, when” at the resource level, complementing provider-native services like AWS CloudTrail. The combination (audit logs + provider CloudTrail-equivalent) covers the CIS logging control for both the change intent (from Terraform) and the change execution (from the cloud provider).

For teams building a broader compliance programme, see our cloud governance platform page for the wider governance context, and the platform engineering metrics guide for how to track change control effectiveness alongside DORA metrics.

Beyond Audit: Day 2 Operations and Continuous Governance

Audit logs are a starting point. In a mature Terraform CI/CD setup, they feed Day 2 governance activities: drift detection (via InfraView), incident forensics (who changed the security group at 03:42?), cost anomaly investigation (which apply added the $8k/month RDS instance?), and continuous compliance reporting. The InfraMap OSS tool visualises Terraform state so audit findings can be traced back to the graph of resources they affect.

FAQ

What is a Terraform CI/CD tool with audit logs?
A Terraform CI/CD tool with audit logs automates infrastructure provisioning through a pipeline while maintaining a tamper-proof record of every plan, apply, and destroy operation – who triggered it, when, and what changed. This audit trail is required for SOC 2, ISO 27001, and CIS benchmark compliance. Unlike Terraform OSS or Atlantis (which require custom log aggregation), platforms like Cycloid and Spacelift provide built-in audit logging as part of the CI/CD pipeline without additional tooling.

Does Terraform natively support audit logs?
Open-source Terraform CLI does not natively produce audit logs. It writes local state file changes but nothing that satisfies a SOC 2 or ISO 27001 auditor: no user attribution, no tamper-proof storage, no retention policy, no query interface. HCP Terraform (formerly Terraform Cloud) offers audit logging on paid plans. Third-party Terraform CI/CD platforms (Cycloid, Spacelift, env0) provide native audit logging as part of the pipeline layer.

How do I add audit logging to a Terraform pipeline?
Three practical options. (1) Use a Terraform CI/CD platform that produces native audit logs (Cycloid, Spacelift, HCP Terraform) – lowest maintenance overhead. (2) Wrap Terraform CLI in a CI/CD system (GitHub Actions, GitLab CI) and aggregate CI logs into a SIEM – flexible but high maintenance. (3) Use Atlantis with a GitHub audit log plugin – lightweight but limited retention and query capability. Option 1 is the standard choice for regulated environments.

What compliance frameworks require Terraform audit logs?
SOC 2 Type II requires continuous evidence of change control effectiveness – who deployed what infrastructure change, when, and under what approval. ISO 27001:2022 requires change management records (Annex A.8.32). PCI DSS requires logging for cardholder data environments. HIPAA requires audit trails for systems handling PHI. CIS benchmarks require change logging as part of hardening. Terraform audit logs are typically the primary evidence source for infrastructure change controls in these frameworks.

Cycloid vs Spacelift vs Atlantis – which has the best audit logging?
Cycloid provides native audit logs across all operations (plan, apply, destroy, policy evaluation) with configurable retention and SIEM export, integrated with InfraPolicies governance. Spacelift offers strong policy-as-code with native audit trail on paid tiers. Atlantis (open source) has no native audit logging – teams typically aggregate GitHub webhook logs into a SIEM, which works but requires DIY. For regulated environments, Cycloid and Spacelift are the two typical shortlists; Atlantis fits teams building their own compliance layer.

See Cycloid’s Terraform CI/CD with native audit logging in action – built for SOC 2, ISO 27001, and multi-cloud governance from one platform.

Book a demo