Soc 2 Compliance Checklist Aws

Standard Operating Procedure: SOC 2 Compliance Checklist AWS

Document Identifier: SOP-SEC-AWS-SOC2-042
Classification: Restricted – Internal Operations & Audit Use Only

---

1. Document Control & Revision History

---

2. Executive Summary & Scope

2.1 Clinical Statement of Operational Boundaries

This Standard Operating Procedure (SOP) defines the mandatory engineering controls, configuration baselines, and verification protocols required to achieve and maintain System and Organization Controls (SOC) 2 Type II compliance across all Amazon Web Services (AWS) cloud environments.

2.2 Regulatory Standards & Trust Services Criteria (TSC)

This procedure operationalizes requirements under the AICPA Trust Services Criteria:

• Security (Common Criteria): Protection against unauthorized access, use, or modification.
• Availability: System availability for operation and use as committed or agreed.
• Processing Integrity: System processing is complete, valid, accurate, timely, and authorized.
• Confidentiality: Information designated as confidential is protected as committed or agreed.
• Privacy: Personal information is collected, used, retained, disclosed, and disposed of in accordance with privacy commitments.

---

3. Prerequisites & Tool Requirements

3.1 Software Access & Permissions

• AWS IAM Access: Multi-Factor Authentication (MFA) enforced root access (break-glass only) and AdministratorAccess assigned exclusively to automated deployment pipelines and authorized Principal Security Engineers.
• Identity Providers: SAML 2.0 compliant Enterprise IdP (e.g., Okta, Azure AD) integrated with AWS IAM Identity Center.
• Infrastructure as Code (IaC): Terraform >= 1.5.x or AWS CloudFormation for immutable infrastructure deployments.
• Compliance Automation Tools: AWS Security Hub, AWS Config, Amazon GuardDuty, and Steampipe or Prowler for continuous compliance posture assessment.

3.2 Certifications & Qualifications

• Personnel executing configuration tasks must hold active certifications including AWS Certified Security – Specialty or AWS Certified Solutions Architect – Professional.
• Auditors must be independent third-party CPA firms accredited under AICPA attestation standards.

---

4. Roles & Responsibilities (RACI Matrix Table)

---

5. Step-by-Step Operational Procedure

Phase 1: Identity and Access Management (CC6.1, CC6.3)

• Enforce AWS Organizations Service Control Policies (SCPs) across all member accounts to restrict root user access, disable region provisioning for unauthorized geographies, and prevent the creation of unencrypted S3 buckets.
• Configure AWS IAM Identity Center with mandatory Hardware MFA (FIDO2/WebAuthn) for all human users.
• Implement least-privilege IAM roles utilizing attribute-based access control (ABAC) and time-bound session durations (maximum 8-hour console duration).
• Audit and remove all static IAM user access keys; replace with temporary security credentials via IAM assumed roles for programmatic access.
• Execute automated weekly reviews of cross-account IAM trust relationships and external principal access via IAM Access Analyzer.

Phase 2: Data Protection & Cryptography (CC6.1, CC6.7)

• Ensure default encryption is enabled globally across all AWS regions for Amazon EBS volumes, RDS databases, and S3 storage classes using AWS Key Management Service (KMS).
• Create dedicated Customer Managed Keys (CMKs) for sensitive data workloads with mandatory automatic key rotation enabled annually.
• Configure S3 bucket policies to explicitly deny unencrypted object uploads (aws:SecureTransport "false") and block all public access at the account level.
• Implement AWS Certificate Manager (ACM) for provisioning, managing, and automatically rotating TLS certificates for all public-facing load balancers and API gateways.

Phase 3: Infrastructure Security & Network Hardening (CC6.6, CC6.8)

• Deploy a hub-and-spoke Virtual Private Cloud (VPC) topology utilizing AWS Transit Gateway, isolating public subnets, private application subnets, and isolated database subnets.
• Restrict all inbound security group rules; eliminate open-to-the-world rules (0.0.0.0/0) on administrative ports (SSH/22, RDP/3389). Use AWS Systems Manager (SSM) Session Manager for administrative access without opening ingress ports.
• Deploy AWS Network Firewall or centralized Next-Generation Firewall (NGFW) appliances for inspection of east-west and north-south VPC traffic.
• Enable Amazon VPC Flow Logs for all VPCs, routing log data to centralized, immutable Amazon S3 buckets with Object Lock enabled (Compliance Mode).

Phase 4: Logging, Monitoring, and Incident Response (CC7.1, CC7.2, CC7.3)

• Enable AWS CloudTrail in all regions with log file integrity validation enabled, writing to a dedicated, read-only audit log AWS account.
• Configure Amazon GuardDuty across all accounts and regions; integrate findings with AWS Security Hub.
• Establish centralized log aggregation using Amazon CloudWatch Logs and AWS OpenSearch or external SIEM platforms (e.g., Datadog, Splunk) with automated log retention set to a minimum of 365 days.
• Configure Amazon CloudWatch alarms and SNS notification topics to alert the Security Operations Center (SOC) immediately for high-severity events (e.g., root account usage, security group modifications, unauthorized API calls).
• Document and test the Incident Response Plan (IRP) via quarterly table-top exercises and simulated cloud security incidents.

Phase 5: Change Management & System Operations (CC8.1)

• Mandate that all infrastructure modifications pass through Infrastructure as Code (IaC) pipelines with peer review requirements enforced in Git repository settings.
• Integrate static code analysis and security scanning tools (e.g., Checkov, tfsec, TFLint) into CI/CD pipelines to block non-compliant configurations prior to deployment.
• Maintain configuration baselines using AWS Systems Manager State Manager and AWS Config rules to detect and auto-remediate drift from approved compliance states.
• Perform annual Disaster Recovery (DR) testing of critical cloud workloads, validating Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO).

---

6. Quality Assurance & Verification Criteria

6.1 Audit Checklist & Acceptance Benchmarks

• AWS Config Compliance Score: 100% compliance rate across all mandatory baseline rules (e.g., s3-bucket-public-read-prohibited, iam-root-access-key-check, encrypted-volumes).
• CloudTrail Log Integrity: 100% verification success rate indicating no logs have been modified or deleted.
• IAM Security Posture: Zero static long-term IAM user access keys active in production environments.
• Vulnerability Remediation Thresholds:
  • Critical Vulnerabilities: Remediation required within 48 hours of detection.
  • High Vulnerabilities: Remediation required within 14 days of detection.
  • Medium/Low Vulnerabilities: Remediation required within 30 to 90 days.

6.2 Tolerance Thresholds

• Drift Detection Lag: Automated remediation scripts must correct out-of-compliance resource configurations within 15 minutes of AWS Config detection.
• Backup Success Rate: 99.9% successful backup execution verified via AWS Backup vault reports over a rolling 30-day window.

---

7. Practical Troubleshooting Scenarios

Scenario 1: AWS Config Rule Failure on Unencrypted S3 Bucket

• Detection: AWS Security Hub triggers a high-severity finding: s3-bucket-server-side-encryption-enabled reports non-compliant for newly provisioned bucket prod-data-store-xyz.
• Immediate Corrective Action Protocol:
  1. Isolate the bucket by applying an immediate deny-all bucket policy via automated script or AWS CLI.
  2. Execute the remediation CLI command to apply default AES-256 or AWS KMS encryption:

     aws s3api put-bucket-encryption --bucket prod-data-store-xyz --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "aws:kms","KMSMasterKeyId": "arn:aws:kms:us-east-1:111122223333:key/alias/production-key"}}]}'
     

  3. Verify remediation by triggering an on-demand AWS Config evaluation for the specific rule.
  4. Log the incident in the compliance tracking system, noting root cause (IaC template missing encryption block) and initiate a mandatory pull request fix.

Scenario 2: Unauthorized Security Group Ingress Modification Detected

• Detection: Amazon CloudWatch Alarm triggers due to an EventBridge rule capturing an AuthorizeSecurityGroupIngress API call opening port 22 to 0.0.0.0/0.
• Immediate Corrective Action Protocol:
  1. Amazon SNS dispatches an immediate alert to the on-call Security Engineer and triggers an AWS Lambda automated remediation function.
  2. The Lambda function evaluates the security group rule ID and revokes the unauthorized ingress rule via API:

     aws ec2 revoke-security-group-ingress --group-id sg-0123456789abcdef0 --protocol tcp --port 22 --cidr 0.0.0.0/0
     

  3. Revoke active sessions for the IAM principal ID that executed the unauthorized change, forcing re-authentication and session invalidation.
  4. Initiate a formal security review and ticket creation to investigate potential credential compromise.