Compliance Frameworks

Compliance frameworks define security and privacy requirements that organizations must meet. Each framework targets specific industries, data types, or regulatory jurisdictions.

SOC 2 (Service Organization Control 2) is a trust service criteria framework for service organizations. It evaluates controls across five criteria: security, availability, processing integrity, confidentiality, and privacy. SOC 2 Type I assesses controls at a point in time; Type II assesses controls over a period (typically 6-12 months). Most SaaS companies need SOC 2 to enterprise customers.

HIPAA (Health Insurance Portability and Accountability Act) protects patient health information (PHI) in the US. HIPAA requires administrative, physical, and technical safeguards. AWS offers a Business Associate Agreement (BAA) for HIPAA-eligible services. Protected data must be encrypted at rest and in transit. Access must be logged and auditable.

PCI DSS (Payment Card Industry Data Security Standard) protects cardholder data for organizations processing, storing, or transmitting credit card numbers. PCI DSS has 12 requirements covering network security, encryption, access control, monitoring, and testing. AWS provides PCI DSS compliance for relevant services, but the customer is responsible for their own compliance within the shared responsibility model.

GDPR (General Data Protection Regulation) is the EU data protection law. It applies to any organization processing EU residents' personal data, regardless of where the organization is located. GDPR requires data minimization, purpose limitation, consent, right to erasure, and breach notification within 72 hours. Penalties can reach 4% of global annual revenue.

FedRAMP (Federal Risk and Authorization Management Program) standardizes security for US government cloud services. FedRAMP has three impact levels: Low (basic data), Moderate (controlled unclassified information), and High (law enforcement, emergency services). AWS GovCloud provides FedRAMP-authorized infrastructure.

AWS Artifact is the portal for accessing AWS compliance documentation. It provides two types of resources: reports and agreements.

AWS Artifact Reports provides compliance reports from third-party auditors. Download SOC 2 Type II reports, PCI DSS Attestations of Compliance, ISO 27001 certificates, and FedRAMP authorization packages. These reports demonstrate that AWS infrastructure meets specific compliance standards.

How to use Artifact Reports: Navigate to AWS Artifact in the console. Search for the report you need (SOC 2, PCI DSS, etc.). Download the report and its associated summary letter. Share reports with auditors and customers during compliance assessments. Reports are updated annually.

AWS Artifact Agreements provides legal agreements for specific compliance requirements. Accept the HIPAA Business Associate Agreement (BAA) to use HIPAA-eligible services. Accept the FedRAMP Business Associate Addendum for government workloads. These agreements are required before deploying compliant workloads.

Shared responsibility model: AWS is responsible for security OF the cloud (physical infrastructure, hypervisor, global network). The customer is responsible for security IN the cloud (data encryption, access control, network configuration, application security). Compliance reports cover AWS responsibilities; customers must implement their own controls for their responsibilities.

Compliance documentation workflow: During an audit, the auditor asks for evidence of controls. Provide AWS Artifact reports for infrastructure compliance. Provide your own documentation for application-level controls: encryption policies, access logs, data retention policies, and incident response procedures.

Example: A healthcare startup building a HIPAA-compliant application. First, accept the HIPAA BAA in AWS Artifact. Then configure encryption (KMS), access control (IAM), logging (CloudTrail), and network security (VPC). The auditor reviews AWS Artifact SOC 2 and HIPAA reports for infrastructure compliance and reviews the startup's documentation for application-level controls.

Compliance requirements translate to specific AWS configurations. Understanding these mappings helps design compliant architectures.

Encryption at rest: AWS Config rule encrypted-volumes checks that EBS volumes are encrypted. Use KMS customer-managed keys for HIPAA and PCI DSS. S3 bucket policy can enforce aws:SecureTransport for encryption in transit. RDS encryption at rest is enabled at creation and cannot be disabled.

Access control: IAM policies implement least-privilege access. AWS Config rule iam-user-unused-credentials-check identifies unused credentials. Organizations SCPs can deny actions outside approved regions. VPC security groups restrict network access to specific ports and IPs.

Logging and monitoring: CloudTrail logs all API calls. Enable CloudTrail in all regions and send logs to a central S3 bucket. AWS Config records resource configurations. Enable Config in all regions. CloudWatch Logs for application logging. These provide audit trails required by SOC 2, HIPAA, and PCI DSS.

Network security: VPC flow logs capture network traffic metadata. NACLs and security groups implement defense in depth. AWS WAF protects web applications from common attacks. VPC endpoints provide private connectivity to AWS services without internet exposure.

Data residency: AWS Config rules approved-amis-by-id and restricted-common-port enforce configuration standards. Use region-specific resources to ensure data stays in required geographic locations. AWS Organizations SCPs can deny resource creation outside approved regions.

AWS Security Hub aggregates findings from multiple security services (GuardDuty, Inspector, Macie, Config Rules) into a single dashboard. Security Hub maps findings to compliance frameworks: a finding tagged as PCI DSS 2.2.1 indicates a specific PCI requirement violation. This accelerates compliance assessments by providing framework-aligned views.