Which AWS services map to which SOC 2 controls?
There is no direct, universal mapping of specific AWS services to individual SOC 2 controls because control satisfaction depends on how an organisation configures and uses those services. AWS provides the secure infrastructure and tools, but the customer is responsible for implementing and operating their environment in a manner that meets the Trust Services Criteria. Effective SOC 2 compliance in AWS requires a detailed assessment of an organisation's unique architecture and operational practices.
The fundamental challenge in mapping AWS services to SOC 2 controls stems from the shared responsibility model. AWS is responsible for the security *of* the cloud, meaning the underlying infrastructure, global network, and physical security. Their own SOC 2 Type 2 report attests to the effectiveness of their controls in this domain. However, the customer is responsible for security *in* the cloud, encompassing configuration of services, data encryption, network controls, access management, and application security. A service like Amazon S3, for instance, offers features for encryption, logging, and access control, but merely using S3 does not automatically satisfy a control; the customer's specific configuration and management of these features determine compliance.
Practitioners should approach this by first defining their organisation's specific controls and then identifying which AWS service features, when properly configured and managed, contribute to meeting those controls. This involves a granular review of each relevant AWS service's capabilities, such as AWS Identity and Access Management (IAM) for access control (CC6.1), AWS CloudTrail for logging and monitoring (CC7.2), and Amazon GuardDuty for threat detection (CC7.1). Documentation of these configurations, along with evidence of their operational effectiveness, is crucial for audit purposes. The mapping is therefore a bespoke exercise, reflecting the unique implementation choices and risk posture of each organisation leveraging AWS services.
Sources
- AICPA Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (2017), Common Criteria (CC)
- AWS Shared Responsibility Model documentation
- AWS Compliance Programs, SOC 2 Report