SOC2 Baseline CloudFormation Stack

SOC2 Baseline CloudFormation Stack

When auditors arrive for your SOC2 Type II assessment, they open the AWS console and look for a specific set of controls. This CloudFormation stack enables every one of them, documented as code, so you can prove they have been continuously active since day one.

What Auditors Check — What This Stack Enables

• AWS Config + Managed Rules — 18 Config rules covering encrypted volumes, public S3 blocks, MFA on root, RDS encryption, and more. All mapped to SOC2 CC controls in the template comments.
• AWS CloudTrail — multi-region trail with log file validation, S3 access logging on the trail bucket, and SNS notification on log delivery
• VPC Flow Logs — enabled on every VPC in the account via a Lambda custom resource, publishing to CloudWatch Logs with a 365-day retention policy
• AWS Access Analyzer — IAM Access Analyzer for the account, alerting on any externally accessible resources
• Security Hub (CIS Standard) — CIS AWS Foundations Benchmark v1.4 enabled and findings exported to an S3 bucket for evidence collection

Evidence Collection Built-In

A second CloudFormation stack (evidence-collector.yaml) deploys a scheduled Lambda that exports Config compliance snapshots, Security Hub findings, and CloudTrail digest files to a dedicated S3 bucket weekly — pre-formatted for auditor handoff.

What You Get

• soc2-baseline.yaml — main CloudFormation template
• evidence-collector.yaml — optional weekly evidence export stack
• control-mapping.md — maps each AWS resource to SOC2 Trust Service Criteria
• README.md — deployment guide and auditor FAQ