Achieving SOC 2 Compliance on AWS: A Developer's Practical Guide
How I led the SOC 2 compliance effort at a SaaS startup, from AWS infrastructure hardening to passing the audit with zero critical findings.
Why SOC 2 Matters for SaaS
When Penguin Benefits started onboarding Fortune 500 clients, every enterprise procurement team asked the same question: "Are you SOC 2 compliant?" Without it, we were locked out of the enterprise market.
SOC 2 isn't just a checkbox -- it's a framework for building trustworthy systems. And as the senior developer, I ended up leading the technical implementation.
The Five Trust Service Criteria
SOC 2 evaluates five areas:
- Security: The foundation -- protecting against unauthorized access
- Availability: System uptime and disaster recovery
- Processing Integrity: Ensuring data processing is complete and accurate
- Confidentiality: Protecting confidential information
- Privacy: Handling personal information appropriately
- Eliminated all use of the root account
- Implemented role-based access with granular policies
- Required MFA for all human accounts
- Used IAM roles (not access keys) for service-to-service communication
- Public subnet: Only the ALB (Application Load Balancer)
- Private subnet: Application servers (no public IPs)
- Isolated subnet: RDS databases (no internet access)
- Security groups: Minimal ingress/egress rules per service
- CloudTrail: Enabled for all regions, logs shipped to a separate audit account
- AWS Config: Continuous compliance monitoring with custom rules
- GuardDuty: Threat detection with automated alerting
- Inspector: Automated vulnerability scanning of EC2 instances
- RDS: Automated daily backups + point-in-time recovery (5-minute granularity)
- Cross-region replication: Backups replicated to us-west-2 (primary is us-east-1)
- KMS encryption: All backups encrypted at rest with customer-managed keys
- RPO achieved: <15 minutes
- VPC, subnets, security groups
- ECS services and task definitions
- RDS from latest snapshot
- Route 53 failover routing
- Unencrypted S3 buckets
- Security groups with 0.0.0.0/0 ingress
- IAM users without MFA
- RDS instances without encryption
- CloudTrail disabled in any region
- Evidence collection: We automated evidence gathering with custom scripts that pulled CloudTrail logs, Config snapshots, and access reviews
- Policy documentation: Created 12 policies covering access control, incident response, change management, and more
- Control testing: Auditors verified controls were operating effectively over 6 months
- Zero critical findings in the Type II audit
- Enterprise deals unlocked: Three Fortune 500 clients signed within 60 days of certification
- Reduced insurance premiums: Our cyber liability insurance dropped 15%
- Developer confidence: The team stopped worrying about "am I doing this securely?" because the guardrails were automated
- Start early: SOC 2 isn't something you bolt on -- build compliance into your architecture from the start
- Automate evidence: Manual evidence collection is unsustainable. Use AWS Config and custom scripts
- Use a readiness assessment: Before the real audit, do a gap analysis. AWS Trusted Advisor is free and catches the obvious issues
- Document decisions: Auditors love seeing documented rationale for security decisions
- Make it part of CI/CD: Security checks in your deployment pipeline prevent regressions
We targeted Security and Availability for our Type II audit.
AWS Infrastructure Hardening
IAM: Least Privilege Everywhere
We audited every IAM role, user, and policy:
VPC: Network Segmentation
Our VPC architecture:
Logging and Monitoring
Disaster Recovery
Enterprise clients required documented disaster recovery:
Backup Strategy
Recovery Stack
We built a complete CloudFormation template that could spin up the entire application in our DR region:
RTO achieved: <2 hours (validated quarterly)
Filling the Gaps with AWS Config
AWS Config was our secret weapon. We created custom rules that continuously checked for:
When a rule was violated, SNS notifications triggered immediate remediation alerts.
The Audit Process
For the Type II audit (covers a period of operation, not a point in time):