{"id":51152311,"url":"https://github.com/thesammykins/jamf_terraform_baselines","last_synced_at":"2026-06-26T07:02:24.408Z","repository":{"id":364992320,"uuid":"1269884655","full_name":"thesammykins/jamf_terraform_baselines","owner":"thesammykins","description":"Terraform modules for NIST mSCP compliance baselines and macAdmin foundation scaffolding for Jamf Pro. 16 frameworks × 3 macOS versions — kept current via CI.","archived":false,"fork":false,"pushed_at":"2026-06-23T03:15:49.000Z","size":1979,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-23T04:06:04.170Z","etag":null,"topics":["compliance","jamf","jamf-pro","macadmin","macos","mscp","nist","security-baselines","terraform","terraform-module"],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/thesammykins.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2026-06-15T07:28:47.000Z","updated_at":"2026-06-23T03:15:47.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/thesammykins/jamf_terraform_baselines","commit_stats":null,"previous_names":["thesammykins/jamf_terraform_baselines"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/thesammykins/jamf_terraform_baselines","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thesammykins%2Fjamf_terraform_baselines","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thesammykins%2Fjamf_terraform_baselines/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thesammykins%2Fjamf_terraform_baselines/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thesammykins%2Fjamf_terraform_baselines/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/thesammykins","download_url":"https://codeload.github.com/thesammykins/jamf_terraform_baselines/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thesammykins%2Fjamf_terraform_baselines/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34806448,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-26T02:00:06.560Z","response_time":106,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["compliance","jamf","jamf-pro","macadmin","macos","mscp","nist","security-baselines","terraform","terraform-module"],"created_at":"2026-06-26T07:02:23.850Z","updated_at":"2026-06-26T07:02:24.396Z","avatar_url":"https://github.com/thesammykins.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"![banner](banner.png)\n\n# jamf_mscp_tf\n\nTerraform modules for deploying NIST mSCP compliance baselines and macAdmin foundation scaffolding into Jamf Pro. 16 compliance frameworks × 3 macOS versions — all kept current via CI.\n\n\u003e **AI-assisted development** — This project was built with the assistance of AI agents. Every module, spec, and pipeline has been human-reviewed and validated through `terraform validate` against the upstream provider schemas. The rubber duck was occasionally silicon-based.\n\n## Prerequisites\n\n- **Terraform** ≥ 1.9\n- **Jamf Platform API** credentials (client ID + secret) — for compliance baselines\n- **Jamf Pro API** credentials (client ID + secret + instance FQDN) — for foundation modules\n\nCreate API credentials in Jamf Pro under **Settings → API roles and clients**.\n\n## Authentication\n\nSet credentials as environment variables (never commit them to the repo):\n\n```bash\nexport TF_VAR_jamfplatform_client_id=\"your-platform-client-id\"\nexport TF_VAR_jamfplatform_client_secret=\"your-platform-client-secret\"\nexport TF_VAR_jamfplatform_base_url=\"https://us.apigw.jamf.com\"\n\nexport TF_VAR_jamfpro_client_id=\"your-pro-client-id\"\nexport TF_VAR_jamfpro_client_secret=\"your-pro-client-secret\"\nexport TF_VAR_jamfpro_instance_fqdn=\"your-org.jamfcloud.com\"\n```\n\nOr create a `terraform.tfvars` file (gitignored):\n\n```hcl\njamfplatform_client_id     = \"your-platform-client-id\"\njamfplatform_client_secret = \"your-platform-client-secret\"\njamfpro_client_id          = \"your-pro-client-id\"\njamfpro_client_secret      = \"your-pro-client-secret\"\njamfpro_instance_fqdn      = \"your-org.jamfcloud.com\"\n```\n\nIf you use 1Password, reference secrets directly with `op://` references.\n\n## Quick start: deploy a compliance baseline\n\n1. Clone this repo into your Terraform project.\n2. Set your Jamf Platform credentials (see above).\n3. Drop this into `main.tf`:\n\n```hcl\nterraform {\n  required_version = \"\u003e= 1.9.0\"\n  required_providers {\n    jamfplatform = {\n      source  = \"Jamf-Concepts/jamfplatform\"\n      version = \"\u003e= 0.17.0\"\n    }\n  }\n}\n\nprovider \"jamfplatform\" {\n  client_id     = var.jamfplatform_client_id\n  client_secret = var.jamfplatform_client_secret\n  base_url      = var.jamfplatform_base_url\n}\n\nmodule \"cis_l1\" {\n  source = \"./modules/compliance/cis_lvl1/macos_26\"\n\n  enforcement_mode = \"MONITOR\"\n}\n```\n\n4. Run the plan to see what would change:\n\n```bash\nterraform init\nterraform plan\n```\n\n5. If the plan looks correct, apply it:\n\n```bash\nterraform apply\n```\n\nStart with `MONITOR` mode. It deploys the benchmark in audit-only mode — no enforcement, just reporting. Switch to `MONITOR_AND_ENFORCE` after you've reviewed the compliance report in Jamf Pro.\n\n## Quick start: scaffold a new Jamf Pro tenant\n\nFoundation modules use the `jamfpro` provider:\n\n```hcl\nterraform {\n  required_version = \"\u003e= 1.9.0\"\n  required_providers {\n    jamfpro = {\n      source  = \"deploymenttheory/jamfpro\"\n      version = \"\u003e= 0.36.0\"\n    }\n  }\n}\n\nprovider \"jamfpro\" {\n  client_id             = var.jamfpro_client_id\n  client_secret         = var.jamfpro_client_secret\n  jamfpro_instance_fqdn = var.jamfpro_instance_fqdn\n  auth_method           = \"oauth2\"\n}\n\n# Enable the modules you need. Start with these:\nmodule \"categories\"                { source = \"./modules/foundation/categories\";                enable_categories        = true }\nmodule \"os_version_smart_groups\"   { source = \"./modules/foundation/os-version-smart-groups\";  enable_smart_groups       = true }\nmodule \"security_baseline\"         { source = \"./modules/foundation/security-baseline\";        enable_security_baseline  = true }\nmodule \"software_updates\"          { source = \"./modules/foundation/software-updates\";         enable_software_updates   = true }\nmodule \"inventory_settings\"        { source = \"./modules/foundation/inventory-settings\";       enable_inventory_settings = true }\n```\n\n## I already manage Jamf Pro — how do I migrate to Terraform?\n\nSee **[docs/MIGRATION.md](docs/MIGRATION.md)** for a step-by-step guide covering:\n- Importing existing configuration profiles as Terraform resources\n- Layering these modules on top of an existing tenant without breaking things\n- Using `terraform plan` to validate before applying\n- Handling naming conflicts with existing resources\n\nThe short version: start by deploying the foundation modules in a dry-run, review what `terraform plan` says it would create, then selectively import or adopt resources. [jamformer](https://github.com/Jamf-Concepts/jamformer) can help you discover and export your existing Jamf configuration as Terraform scaffolding.\n\n## Module reference\n\n### Compliance baselines (Variant A)\n\n| Module path | Framework | Rules |\n|---|---|---|\n| `compliance/800-53r5_high/macos_{14,15,26}` | NIST SP 800-53 Rev 5 — High | — |\n| `compliance/800-53r5_moderate/macos_{14,15,26}` | NIST SP 800-53 Rev 5 — Moderate | — |\n| `compliance/800-53r5_low/macos_{14,15,26}` | NIST SP 800-53 Rev 5 — Low | — |\n| `compliance/800-53r5_privacy/macos_{14,15,26}` | NIST SP 800-53 Rev 5 — Privacy | pending upstream |\n| `compliance/800-171/macos_{14,15,26}` | NIST SP 800-171 Rev 3 | — |\n| `compliance/disa_stig/macos_{14,15,26}` | DISA macOS STIG | — |\n| `compliance/cmmc_lvl1/macos_{14,15,26}` | CMMC 2.0 — Level 1 | — |\n| `compliance/cmmc_lvl2/macos_{14,15,26}` | CMMC 2.0 — Level 2 | — |\n| `compliance/cnssi-1253_high/macos_{14,15,26}` | CNSSI 1253 — High | — |\n| `compliance/cnssi-1253_moderate/macos_{14,15,26}` | CNSSI 1253 — Moderate | — |\n| `compliance/cnssi-1253_low/macos_{14,15,26}` | CNSSI 1253 — Low | — |\n| `compliance/nlmapgov_base/macos_{14,15,26}` | Netherlands BIO — Base | — |\n| `compliance/nlmapgov_plus/macos_{14,15,26}` | Netherlands BIO — Plus | — |\n| `compliance/hicp_lp/macos_{14,15,26}` | HICP Large Healthcare | — |\n| `compliance/cis_lvl1/macos_{14,15,26}` | CIS macOS Benchmark — Level 1 | — |\n| `compliance/cis_lvl2/macos_{14,15,26}` | CIS macOS Benchmark — Level 2 | — |\n| `compliance/cisv8/macos_{14,15,26}` | CIS Controls v8 | — |\n\nEach compliance module accepts:\n- `enforcement_mode` — `\"MONITOR\"` or `\"MONITOR_AND_ENFORCE\"`\n- `disabled_rules` — rule IDs to permanently disable\n- `rule_overrides` — organization-defined value overrides per rule\n- `exemptions` — waive rules with audit justification\n\n### Foundation modules (Variant B)\n\n| Module path | What it creates | Key variables |\n|---|---|---|\n| `foundation/categories` | Standard Jamf Pro categories | `enable_categories` |\n| `foundation/os-version-smart-groups` | Smart groups per macOS version | `enable_smart_groups` |\n| `foundation/security-baseline` | FileVault, firewall, screensaver, Gatekeeper | `enable_security_baseline`, `screensaver_idle_timeout_minutes` |\n| `foundation/software-updates` | DDM-native update deferral policies | `enable_software_updates`, `ddm_update_action`, `ddm_max_deferrals` |\n| `foundation/pppc-screen-capture` | PPPC profile for collaboration tools | `enable_pppc_screen_capture`, `pppc_tools` |\n| `foundation/pppc-accessibility` | PPPC accessibility profile | `enable_pppc_accessibility`, `pppc_tools` |\n| `foundation/device-enrollment` | ADE PreStage enrollment settings | `enable_device_enrollment` |\n| `foundation/inventory-settings` | Check-in frequency and collection config | `enable_inventory_settings`, `checkin_frequency_minutes` |\n| `foundation/intelligence-settings` | Apple Intelligence DDM controls (macOS 26.4+) | `enable_intelligence_settings`, `use_legacy_profile` |\n| `foundation/external-intelligence-settings` | Third-party AI integration controls (macOS 26.4+) | `enable_external_intelligence_settings`, `use_legacy_profile` |\n\n## Exemption tracking\n\nEvery module supports an `exemptions` map. Instead of commenting out rules, declare why they're waived:\n\n```hcl\nexemptions = {\n  \"os_airdrop_disable\" = {\n    reason      = \"Field researchers share data between managed devices\"\n    ticket      = \"GRC-2025-089\"\n    risk_status = \"ACCEPTED\"\n  }\n  \"system_settings_bluetooth_disable\" = {\n    reason      = \"Bluetooth required for wireless peripherals\"\n    ticket      = \"IT-9012\"\n    risk_status = \"TEMPORARY\"\n    expires     = \"2026-09-30\"\n    reviewer    = \"ciso@example.com\"\n  }\n}\n```\n\nExemptions appear in `terraform plan`, are emitted as JSON for GRC tools, and expired temporary exemptions block CI merges.\n\n## Safe deployment checklist\n\n1. **Always `plan` first.** Run `terraform plan` and review every resource that would be created or changed.\n2. **Start with `MONITOR`.** Compliance baselines default to audit-only mode. Switch to enforcement after reviewing reports.\n3. **Use `terraform import` for existing resources.** Don't let Terraform recreate things you already have. See the migration guide.\n4. **Test on a staging tenant** if you have one.\n5. **Pin your dependency** on a specific git tag or commit SHA. Updates arrive as opt-in PR merges — you're never force-upgraded.\n6. **Check CI exemption results.** Expired exemptions block PRs. Keep your `expires` dates honest.\n\n## CI pipeline\n\n- **Compliance update** — quarterly. Polls mSCP releases, regenerates modules, opens a PR with a rule-level changelog.\n- **Foundation update** — monthly. Checks for PPPC bundle ID updates and provider version bumps.\n- **Exemption check** — every push and PR. Validates exemption expiry dates and completeness.\n\nYou can also trigger compliance and foundation updates manually via `workflow_dispatch`.\n\n## Docs\n\n| Document | What it covers |\n|---|---|\n| [docs/MIGRATION.md](docs/MIGRATION.md) | Importing existing Jamf configs into Terraform |\n| [CONTRIBUTING.md](CONTRIBUTING.md) | Development setup, code style, PR requirements |\n| [SECURITY.md](SECURITY.md) | Reporting vulnerabilities |\n| [specs/mscp-terraform-pipeline/PRODUCT.md](specs/mscp-terraform-pipeline/PRODUCT.md) | Full product spec — all baselines, exemption system, success criteria |\n| [specs/mscp-terraform-pipeline/TECH.md](specs/mscp-terraform-pipeline/TECH.md) | Architecture — generator logic, CI design, key decisions |\n| [LICENSE](LICENSE) | Apache 2.0 |\n\n## Disclaimer\n\nThis software is provided \"as is\", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, and non-infringement. In no event shall the contributors be liable for any claim, damages, or other liability arising from the use or deployment of these Terraform modules.\n\n**You are responsible for:**\n- Reviewing every `terraform plan` before applying changes.\n- Testing modules in a non-production environment first.\n- Understanding what each module does before enabling it in your tenant.\n- Maintaining your own backups and rollback strategy.\n\nThese modules interact with your Jamf Pro instance — a misconfigured baseline or an accidental destroy can disrupt managed devices. Start with `MONITOR` mode, read the migration guide, and don't apply blindly.\n\n---\n\n*To be perfectly honest, I'm not entirely sure this repo needed to exist — the compliance modules are auto-generated from upstream NIST data and the foundation modules are pretty basic Jamf scaffolding. But `modules/foundation/` is open for meaningful contributions: baseline configurations, real-world policy bundles, or whatever collective Jamf admin wisdom ends up here. PRs welcome.*\n\n## License\n\nApache 2.0. See [LICENSE](LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthesammykins%2Fjamf_terraform_baselines","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fthesammykins%2Fjamf_terraform_baselines","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthesammykins%2Fjamf_terraform_baselines/lists"}