soc2-compliance-automation

SOC 2 Compliance Automation & Governance Guidelines

This skill provides technical architectures, Policy-as-Code rules, automated evidence collection routines, continuous monitoring frameworks, and IAM control standards for achieving and maintaining SOC 2 Type II compliance across cloud infrastructure.

---

1. SOC 2 Trust Services Criteria (TSC) Mapping

SOC 2 audits evaluate five core Trust Services Criteria:

+-------------------------------------------------------------------------+
|                  CC (Common Criteria / Security)                        |
|   CC6.1 (Access Controls)  | CC6.8 (Malware/Patching) | CC7.2 (Monitoring)|
+-------------------------------------------------------------------------+
       |                         |                        |
       v                         v                        v
+------------------+   +-------------------+   +--------------------+
|  Availability    |   | Confidentiality   |   | Processing Integrity|
| (A1.2 Uptime/DR) |   | (C1.1 KMS Encrypt)|   | (PI1.1 Data Valid) |
+------------------+   +-------------------+   +--------------------+

1. CC6.1 (Access Control & Identity): Multi-Factor Authentication (MFA), SSO enforcement, Role-Based Access Control (RBAC), Least Privilege principle.
2. CC6.6 & CC6.7 (Boundary Protection & Encryption): Encryption at rest (AES-256) and in transit (TLS 1.3), VPC isolation, WAF configuration.
3. CC7.1 & CC7.2 (Change Management & Monitoring): Automated CI/CD branch protection, peer code review requirements, SIEM audit logging.
4. A1.2 (Availability & Disaster Recovery): Multi-AZ infrastructure replication, automated database backup retention, failover testing.

---

2. Infrastructure-as-Code SOC 2 Policy Enforcement (Open Policy Agent / OPA)

Prevent non-compliant infrastructure provisioning during CI/CD execution using OPA Rego rules:

# policy/soc2_aws_security.rego
package terraform.soc2

import future.keywords.in

default allow = false

# Rule: Enforce S3 Bucket Public Access Block & AES-256 Encryption (CC6.6)
deny[msg] {
    resource := input.resource_changes[_]
    resource.type == "aws_s3_bucket"
    not resource.change.after.server_side_encryption_configuration
    msg := sprintf("SOC 2 Violation [CC6.6]: S3 Bucket '%v' must have server-side encryption enabled.", [resource.name])
}

deny[msg] {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    resource.change.after.publicly_accessible == true
    msg := sprintf("SOC 2 Violation [CC6.1]: RDS Database '%v' must NOT be publicly accessible.", [resource.name])
}

deny[msg] {
    resource := input.resource_changes[_]
    resource.type == "aws_security_group_rule"
    resource.change.after.cidr_blocks[_] == "0.0.0.0/0"
    resource.change.after.from_port == 22
    msg := sprintf("SOC 2 Violation [CC6.1]: Security Group Rule '%v' allows SSH (Port 22) from world (0.0.0.0/0).", [resource.name])
}