B2B SaaS Starter Kit: SOC 2

For B2B SaaS companies heading toward SOC 2 Type I or II. Deploys the infrastructure layer your auditor will ask about: encrypted databases, private subnets, HTTPS-only endpoints, access logging, Multi-AZ data stores.

GitHub: compliancetf/starter-kit-saas-soc2

Registry: soc2.compliance.tf

Resources deployed: approximately 107

Architecture

The architecture covers the typical SaaS application layer: a public-facing ALB with WAF, a private EKS cluster, an Aurora PostgreSQL database in dedicated database subnets, and shared services (S3, DynamoDB, ElastiCache, SQS). VPC flow logs and CloudWatch log groups are included for CC7.1.

Module Inventory

Quick Start

Prerequisites: Terraform >= 1.3, AWS credentials, a compliance.tf account, a Route 53 hosted zone, and an S3 replication IAM role + destination bucket for cross-region replication (required for SOC 2 A1.2).

git clone https://github.com/compliancetf/starter-kit-saas-soc2.git
cd starter-kit-saas-soc2

cp terraform.tfvars.example terraform.tfvars
# Edit terraform.tfvars: set project_name, domain_name, route53_zone_id,
# availability_zones, s3_replication_role_arn, s3_replication_destination_bucket_arn

terraform login soc2.compliance.tf

terraform init
terraform plan
terraform apply

terraform plan fails if any SOC 2 control is violated. The error names the specific control and the module that triggered it. Fix the issue and re-run.

SOC 2 Control Coverage

What compliance.tf Covers vs. What You Own

compliance.tf enforces the infrastructure controls in SOC 2. The table below shows the split.

What this kit handles

• Encryption at rest and in transit for all data stores
• S3 cross-region replication (SOC 2 A1.2 data durability)
• Network isolation: private subnets, database subnets, no public database access
• TLS 1.2+ on all external endpoints, enforced by the registry at plan time
• Access logging: VPC flow logs, ALB access logs, Aurora PostgreSQL logs
• Multi-AZ and automated backups
• Deletion protection in production (environment = "prod")
• Validation at terraform plan; non-compliant configurations fail before deployment

What you own

• Application-level authentication, authorization, and session management
• Identity provider configuration and MFA enforcement
• HR policies: background checks, security awareness training
• Vendor management and third-party risk assessments
• Incident response procedures and runbooks
• Business continuity planning
• Access reviews and user lifecycle management
• Application-level audit logging for business events

compliance.tf does not replace a SOC 2 auditor. It covers the infrastructure controls. The audit will still cover organizational controls (HR policies, access reviews, incident response, vendor management) but not whether Aurora is encrypted or S3 blocks public access.

Vanta and Drata Integration

compliance.tf evidence maps directly to the categories that Vanta and Drata check automatically.

For evidence collection, point your compliance platform at the Terraform state or the AWS resource tags. All modules in this kit tag resources with Project, Environment, and ManagedBy = "terraform" so resources are easy to scope during evidence gathering.

Common Customizations

Swap EKS for ECS

Remove the eks module block from main.tf and replace it with the ecs module from soc2.compliance.tf. Update the ALB target group to point at your ECS service instead of EKS pods.

module "ecs" {
  source  = "soc2.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "~> 5.0"

  cluster_name = local.name

  fargate_capacity_providers = {
    FARGATE = {
      default_capacity_provider_strategy = {
        weight = 100
      }
    }
  }

  tags = var.tags
}

Add a second region for disaster recovery

S3 cross-region replication is already configured for the data and logs buckets via the s3_replication_role_arn and s3_replication_destination_bucket_arn variables. To extend DR to compute and database layers, use a second provider alias and duplicate the relevant module blocks:

provider "aws" {
  alias  = "dr"
  region = "us-west-2"
}

Use Aurora Global Database for database replication across regions.

Adjust instance sizes

All instance sizes are variables. Override them in terraform.tfvars:

eks_node_instance_types = ["m6i.xlarge"]
eks_node_min_size       = 3
eks_node_max_size       = 10

aurora_instance_class   = "db.r6g.xlarge"
redis_node_type         = "cache.r6g.large"

Remove a module you don't need

If your application does not use DynamoDB or SQS, delete those module blocks from main.tf and remove the corresponding outputs. The remaining modules are independent; removing one does not break others.

Disable a specific control

If a SOC 2 control does not apply to your use case, disable it with a query parameter on the module source:

module "s3_bucket_data" {
  source  = "soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws?disable=s3_bucket_object_lock_enabled"
  version = "~> 5.0"
  # ...
}

Cost Estimate

Actual costs depend on usage, data transfer, and region. Use Infracost to get an estimate from your actual terraform plan output.

Next Steps

• Brownfield Migration Kit: if you have existing Terraform using terraform-aws-modules, migrate to compliance.tf instead of deploying fresh
• Audit Evidence Guide: how to prepare infrastructure evidence for SOC 2 auditors
• SOC 2 Framework Reference: full list of controls enforced per criterion
• Version Compatibility Matrix: which upstream module versions compliance.tf supports