soc2

const (
	PolicyGCPIAMNoOwnerRoleForUsers      = "soc2.cc6.1.gcp_iam_no_owner_role_for_users"
	PolicyGCSBucketUniformAccess         = "soc2.cc6.7.gcs_bucket_uniform_access"
	PolicyComputeNoDefaultServiceAccount = "soc2.cc6.6.compute_no_default_service_account"
	PolicyCloudSQLRequireSSL             = "soc2.cc6.7.cloudsql_require_ssl"
)

GCP policy IDs — exported so tests and other packages can reference them by symbol rather than string-literal.

const (
	PolicyGitHubBranchProtection = "soc2.cc6.6.github_branch_protection_on_default"
	PolicyGitHubMembers2FA       = "soc2.cc6.1.github_org_members_have_2fa"
	PolicyOktaUsersMFA           = "soc2.cc6.1.okta_users_have_mfa"
	PolicyOktaAppsMFA            = "soc2.cc6.7.okta_apps_require_mfa"
)

Identity-source policy IDs. These four policies demonstrate the github and okta source plugins under their natural SOC 2 controls.

const (
	PolicyCloudTrailMultiRegionEnabled = "soc2.cc7.2.cloudtrail_multiregion_enabled"
	PolicyCloudWatchLogsRetentionSet   = "soc2.cc7.2.cloudwatch_logs_retention_set"
	PolicyGuardDutyEnabled             = "soc2.cc7.1.guardduty_enabled"
	PolicyConfigRecorderEnabled        = "soc2.cc7.1.config_recorder_enabled"
)

Infrastructure-source policy IDs. These four policies demonstrate the cloudtrail, cloudwatch, guardduty, and config (configservice) source plugins under their natural SOC 2 controls (CC7.1 monitoring + CC7.2 system operations / log capture).

const FrameworkID = "soc2"

FrameworkID is the registered identifier.

const FrameworkVersion = "soc2-2017@0.1.0"

FrameworkVersion stamps every PolicyRef returned by this framework.

const PolicyAccessReview = "soc2.cc6.3.access_review_quarterly"

PolicyAccessReview is the manual policy demonstrating manual.pdf → signed_document consumption.

const PolicyEC2NoPublicIP = "soc2.cc6.6.ec2_no_public_ip"

PolicyEC2NoPublicIP is the policy that fails when any EC2 instance has a public IP address (SOC 2 CC6.6 — restrict external network access).

const PolicyEKSSecretsEncryption = "soc2.cc6.7.eks_secrets_encryption" // #nosec G101 -- policy identifier, not a credential. gitleaks:allow

PolicyEKSSecretsEncryption is the policy that fails when any EKS cluster lacks envelope encryption for Kubernetes secrets (SOC 2 CC6.7).

const PolicyKMSKeyRotation = "soc2.cc6.7.kms_key_rotation_enabled" // #nosec G101 -- policy identifier, not a credential. gitleaks:allow

PolicyKMSKeyRotation is the policy that fails when any customer- managed CMK has automatic rotation disabled (SOC 2 CC6.7).

const PolicyMFAEnforced = "soc2.cc6.1.mfa_enforced"

PolicyMFAEnforced is the automated policy demonstrating aws.iam → user_record consumption.

const PolicyMFAUnion = "soc2.cc6.1.mfa_enforced_all_sources"

PolicyMFAUnion is the cross-source policy demonstrating slot union: the user_directory slot binds multiple sources (in M6's fixture, only aws.iam is registered, but the slot's cardinality is `one-or-more` so a second source can be added without policy change).

const PolicyRDSEncryptionAtRest = "soc2.cc6.7.rds_encryption_at_rest"

PolicyRDSEncryptionAtRest is the policy that fails when any RDS instance has StorageEncrypted=false (SOC 2 CC6.7).

const PolicyS3BucketEncrypted = "soc2.cc6.7.s3_bucket_encrypted"

PolicyS3BucketEncrypted is the policy that fails when any S3 bucket has no default server-side encryption (SOC 2 CC6.7).