Soc2 Compliance Automation

---
name: soc2-compliance-automation
metadata:
  category: Compliance Governance and Legal Tech
description: Best practices for implementing SOC 2 Type II compliance controls, continuous evidence collection, infrastructure policy-as-code, and automated security monitoring. Use when automating Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy), audit logging, IAM least privilege, or CI/CD security gates.
compatibility: AWS/GCP/Azure, Terraform, Open Policy Agent (OPA), SIEM / Audit Logs, GitHub Actions
---

# SOC 2 Compliance Automation & Governance Guidelines

This skill provides technical architectures, Policy-as-Code rules, automated evidence collection routines, continuous monitoring frameworks, and IAM control standards for achieving and maintaining SOC 2 Type II compliance across cloud infrastructure.

---

## 1. SOC 2 Trust Services Criteria (TSC) Mapping

SOC 2 audits evaluate five core Trust Services Criteria:

```
+-------------------------------------------------------------------------+
|                  CC (Common Criteria / Security)                        |
|   CC6.1 (Access Controls)  | CC6.8 (Malware/Patching) | CC7.2 (Monitoring)|
+-------------------------------------------------------------------------+
       |                         |                        |
       v                         v                        v
+------------------+   +-------------------+   +--------------------+
|  Availability    |   | Confidentiality   |   | Processing Integrity|
| (A1.2 Uptime/DR) |   | (C1.1 KMS Encrypt)|   | (PI1.1 Data Valid) |
+------------------+   +-------------------+   +--------------------+
```

1. **CC6.1 (Access Control & Identity)**: Multi-Factor Authentication (MFA), SSO enforcement, Role-Based Access Control (RBAC), Least Privilege principle.
2. **CC6.6 & CC6.7 (Boundary Protection & Encryption)**: Encryption at rest (AES-256) and in transit (TLS 1.3), VPC isolation, WAF configuration.
3. **CC7.1 & CC7.2 (Change Management & Monitoring)**: Automated CI/CD branch protection, peer code review requirements, SIEM audit logging.
4. **A1.2 (Availability & Disaster Recovery)**: Multi-AZ infrastructure replication, automated database backup retention, failover testing.

---

## 2. Infrastructure-as-Code SOC 2 Policy Enforcement (Open Policy Agent / OPA)

Prevent non-compliant infrastructure provisioning during CI/CD execution using OPA Rego rules:

```rego
# policy/soc2_aws_security.rego
package terraform.soc2

import future.keywords.in

default allow = false

# Rule: Enforce S3 Bucket Public Access Block & AES-256 Encryption (CC6.6)
deny[msg] {
    resource := input.resource_changes[_]
    resource.type == "aws_s3_bucket"
    not resource.change.after.server_side_encryption_configuration
    msg := sprintf("SOC 2 Violation [CC6.6]: S3 Bucket '%v' must have server-side encryption enabled.", [resource.name])
}

deny[msg] {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    resource.change.after.publicly_accessible == true
    msg := sprintf("SOC 2 Violation [CC6.1]: RDS Database '%v' must NOT be publicly accessible.", [resource.name])
}

deny[msg] {
    resource := input.resource_changes[_]
    resource.type == "aws_security_group_rule"
    resource.change.after.cidr_blocks[_] == "0.0.0.0/0"
    resource.change.after.from_port == 22
    msg := sprintf("SOC 2 Violation [CC6.1]: Security Group Rule '%v' allows SSH (Port 22) from world (0.0.0.0/0).", [resource.name])
}
```

---

## 3. Continuous Compliance Evidence Collector (Python / AWS SDK)

Automate evidence collection tasks for auditors (e.g. Vanta, Drata, Tugboat, or external CPA auditors) via python scripts:

```python
import boto3
import json
import datetime
from typing import Dict, List

class SOC2EvidenceCollector:
    def __init__(self):
        self.iam_client = boto3.client('iam')
        self.s3_client = boto3.client('s3')
        self.kms_client = boto3.client('kms')

    def Audit_CC6_1_MFA_Enforcement(self) -> Dict:
        """Audits IAM Users to ensure MFA is enabled on all active accounts."""
        users = self.iam_client.list_users()['Users']
        non_compliant_users = []
        total_users = len(users)

        for user in users:
            username = user['UserName']
            mfa_devices = self.iam_client.list_mfa_devices(UserName=username)['MFADevices']
            if not mfa_devices:
                non_compliant_users.append(username)

        result = {
            "control": "CC6.1 - Logical Access Control & MFA",
            "timestamp": datetime.datetime.now(datetime.timezone.utc).isoformat(),
            "status": "PASS" if not non_compliant_users else "FAIL",
            "total_users": total_users,
            "non_compliant_users": non_compliant_users
        }
        return result

    def Audit_CC6_6_S3_Encryption(self) -> List[Dict]:
        """Audits all S3 buckets for default server-side encryption."""
        buckets = self.s3_client.list_buckets()['Buckets']
        audit_report = []

        for bucket in buckets:
            name = bucket['Name']
            try:
                enc = self.s3_client.get_bucket_encryption(Bucket=name)
                status = "ENCRYPTED"
            except self.s3_client.exceptions.ClientError:
                status = "UNENCRYPTED"

            audit_report.append({"bucket_name": name, "status": status})

        return audit_report

if __name__ == "__main__":
    collector = SOC2EvidenceCollector()
    mfa_report = collector.Audit_CC6_1_MFA_Enforcement()
    print(json.dumps(mfa_report, indent=2))
```

---

## 4. Anti-Patterns & Critical Pitfalls

| Anti-Pattern | Severity | Consequence | Correct Pattern |
|---|---|---|---|
| Admin credentials without MFA | Critical | Immediate SOC 2 Audit Exception / Failure | Enforce MFA on all IAM accounts & SSO |
| Direct production database access without break-glass logs | Critical | Severe CC6.1 Audit finding | Use ephemeral Bastion host access with full session logging (Teleport/SSM) |
| Code merged to main branch without 2 PR approvals | High | CC7.1 Change Management violation | Configure GitHub Branch Protection with strict mandatory approvals |
| Static AWS keys embedded in application code | High | Secret compromise & compliance audit flag | Use IAM Roles for EC2/ECS/EKS via OIDC / Instance Profiles |
| Unencrypted database backups in S3 | High | CC6.6 Encryption violation | Enforce AWS KMS CMK encryption on all backup targets |

---

## 5. Automated CI/CD Compliance Gate (GitHub Actions)

```yaml
name: SOC 2 Compliance Gate

on:
  pull_request:
    branches: [ main ]

jobs:
  compliance-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Terraform Security Scan (tfsec)
        uses: aquasecurity/tfsec-action@v1.0.0
        with:
          soft_fail: false

      - name: Open Policy Agent SOC 2 Validation
        run: |
          curl -L -o opa https://openpolicyagent.org/downloads/v0.60.0/opa_linux_amd64_static
          chmod +x opa
          ./opa test policy/ -v
```

---

## 6. Audit Readiness Checklist

- [ ] **Continuous Evidence Gathering**: Ensure automated evidence collection scripts run daily and persist to immutable storage.
- [ ] **Access Reviews**: Document quarterly user access reviews across AWS, GitHub, Okta, and Jira.
- [ ] **Vulnerability Management**: Run weekly container vulnerability scans (Trivy) and remediate High/Critical CVEs within 14 days.