soc2

const (
	PolicyGCPIAMNoOwnerRoleForUsers        = "soc2.cc6.1.gcp_iam_no_owner_role_for_users"
	PolicyObjectStoragePublicAccessBlocked = "soc2.cc6.7.object_storage_public_access_blocked"
	PolicyComputeNoDefaultServiceAccount   = "soc2.cc6.6.compute_no_default_service_account"
	PolicyCloudSQLRequireSSL               = "soc2.cc6.7.cloudsql_require_ssl"
)

GCP policy IDs — exported so tests and other packages can reference them by symbol rather than string-literal. PolicyObjectStorageBlocked is cross-vendor (it accepts object_storage_bucket from any cloud source — S3, GCS, Azure Blob) even though it lives in this file for historical reasons; the gcs_bucket_uniform_access policy it replaces was GCS-only.

const (
	PolicyGitDefaultBranchProtected = "soc2.cc6.6.git_default_branch_protected"
	PolicyOktaAppsMFA               = "soc2.cc6.7.okta_apps_require_mfa"
)

Identity-source policy IDs. The per-source MFA policies that used to live here (okta_users_have_mfa, github_org_members_have_2fa, aws_iam mfa_enforced) collapsed into the canonical source-agnostic PolicyMFAUnion now that all three plugins emit the cross-vendor directory_user shape. The repository branch-protection policy is now cross-vendor (accepts git_repository from GitHub, GitLab, Bitbucket, …). okta_app stays Okta-specific — SAML/OIDC app catalogs have no cross-vendor analog yet.

const (
	PolicyCloudTrailMultiRegionEnabled = "soc2.cc7.2.cloudtrail_multiregion_enabled"
	PolicyCloudWatchLogsRetentionSet   = "soc2.cc7.2.cloudwatch_logs_retention_set"
	PolicyGuardDutyEnabled             = "soc2.cc7.1.guardduty_enabled"
	PolicyConfigRecorderEnabled        = "soc2.cc7.1.config_recorder_enabled"
)

Infrastructure-source policy IDs. These four policies demonstrate the cloudtrail, cloudwatch, guardduty, and config (configservice) source plugins under their natural SOC 2 controls (CC7.1 monitoring + CC7.2 system operations / log capture).

const FrameworkID = "soc2"

FrameworkID is the registered identifier.

const FrameworkVersion = "soc2-2017@0.1.0"

FrameworkVersion stamps every PolicyRef returned by this framework.

const PolicyAccessReview = "soc2.cc6.3.access_review_quarterly"

PolicyAccessReview is the manual policy demonstrating manual.pdf → signed_document consumption.

const PolicyEC2NoPublicIP = "soc2.cc6.6.ec2_no_public_ip"

PolicyEC2NoPublicIP is the policy that fails when any EC2 instance has a public IP address (SOC 2 CC6.6 — restrict external network access).

const PolicyEKSSecretsEncryption = "soc2.cc6.7.eks_secrets_encryption" // #nosec G101 -- policy identifier, not a credential. gitleaks:allow

PolicyEKSSecretsEncryption is the policy that fails when any EKS cluster lacks envelope encryption for Kubernetes secrets (SOC 2 CC6.7).

const PolicyKMSKeyRotation = "soc2.cc6.7.kms_key_rotation_enabled" // #nosec G101 -- policy identifier, not a credential. gitleaks:allow

PolicyKMSKeyRotation is the policy that fails when any customer- managed CMK has automatic rotation disabled (SOC 2 CC6.7).

const PolicyMFAUnion = "soc2.cc6.1.mfa_enforced_all_sources"

PolicyMFAUnion is the canonical MFA-enforcement policy. Its user_directory slot accepts directory_user — the cross-vendor identity shape that aws.iam, okta, github (org members), and future Azure AD/LDAP plugins all emit — with one-or-more cardinality, so the rule runs once against the union of every bound directory source. There is no per-source MFA policy: the rule logic is source-agnostic and a separate Okta-only or GitHub-only audit lens is a project-config concern (binding restrictions), not a duplicate framework policy.

const PolicyObjectStorageEncryptedAtRest = "soc2.cc6.7.object_storage_encrypted_at_rest"

PolicyObjectStorageEncryptedAtRest is the cross-vendor policy that fails when any object_storage_bucket (S3, GCS, Azure Blob, …) lacks server-side encryption at rest (SOC 2 CC6.7). The rule logic is source-agnostic; a project that has both AWS S3 and GCS sources registered sees one consolidated result spanning both clouds.

const PolicyRDSEncryptionAtRest = "soc2.cc6.7.rds_encryption_at_rest"

PolicyRDSEncryptionAtRest is the policy that fails when any RDS instance has StorageEncrypted=false (SOC 2 CC6.7).