Skip to content

SOC 2

Service Organization Control 2 (SOC 2) is an auditing framework developed by the American Institute of Certified Public Accountants (AICPA) for evaluating service organizations' security, availability, processing integrity, confidentiality, and privacy controls. Based on the Trust Services Criteria, SOC 2 reports provide assurance to customers about a service provider's internal controls. It is primarily used by technology and cloud service providers globally to demonstrate security practices to customers and stakeholders.

Terraform Registry Subdomain: soc2

module "..." {
  source  = "soc2.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

module "..." {
  source = "https://soc2.compliance.tf/terraform-aws-modules/<module>/aws"
}

Refer to the Terraform Registry Endpoints section for more details.

Implemented Controls

The following controls are implemented as part of this framework.

Enable/Disable Controls

You can customize the Terraform module for the desired compliance requirements by enabling/disabling individual controls.

Examples

S3 bucket module with SOC 2 compliance framework controls enabled, and a couple of controls disabled

module "..." {
  source = "https://soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws?disable=apigateway_stage_cache_encryption_at_rest_enabled,apigateway_stage_logging_enabled"
}