Status: Stable

Compliance Examples

SOC 2 Trust Services Criteria controls implemented as Terraform — covering IAM, encryption, audit logging, network security, detection, incident response, vulnerability management, and backup.

Examples

Quick Start

# Install Checkov
pip install checkov

# Run all SOC 2 checks against your Terraform
checkov -d . --config-file examples/compliance/checkov-config.yaml

# Run checks for a specific criterion (e.g. CC6.7 encryption)
checkov -d . --check CKV_AWS_7,CKV_AWS_19,CKV_AWS_16,CKV_AWS_17

# Validate a single file
checkov -f logging/cloudtrail.tf

Apply an example

cd examples/compliance/logging
terraform init
terraform plan -var="environment=production"

SOC 2 Coverage Map

Checkov Suppressions

Use the documented suppression format in checkov-config.yaml to acknowledge accepted risks:

#checkov:skip=CKV_AWS_18:Access logging not required for this internal bucket
resource "aws_s3_bucket" "internal_logs" { ... }

See Also

• references/compliance.md — full SOC 2 TSC mapping, Terraform patterns, Checkov rules, evidence commands, pre-audit checklist
• /platform-skills:compliance — gap analysis, control implementation, evidence collection, Checkov remediation, full readiness checklist