Custom Checkov policies for SOC2 compliance validation across AWS, GCP, Azure, and DigitalOcean infrastructure as code.

This repository contains comprehensive Checkov custom policies designed to validate Terraform configurations against SOC2 compliance requirements. The policies cover the five Trust Services Criteria:

• Security: Encryption, access controls, network security
• Availability: High availability, backup and recovery
• Processing Integrity: Monitoring, logging, audit trails
• Confidentiality: Data protection, encryption
• Privacy: Access controls, data isolation

• AWS (Amazon Web Services)
• GCP (Google Cloud Platform)
• Azure (Microsoft Azure)
• DigitalOcean

• Data at rest encryption (S3, EBS, RDS, GCS, Cloud SQL, etc.)
• Data in transit encryption (HTTPS/TLS for load balancers)
• Customer-managed encryption keys (CMEK)

• Password policies and MFA requirements
• Least privilege access
• Service account security
• SSH key enforcement
• Public access restrictions

• Audit logging (CloudTrail, Cloud Logging)
• Access logs for storage and load balancers
• VPC flow logs
• Log retention policies
• Database audit logs

• Security group and firewall restrictions
• SSH/RDP access controls
• Public IP restrictions
• Network isolation and segmentation
• VPC configuration

• Automated backups
• Backup retention policies
• Point-in-time recovery
• High availability configurations
• Snapshot policies

• Python 3.7+
• Checkov installed (pip install checkov)
• Terraform configurations to scan

1. Clone or download this repository:

git clone <repository-url>
cd soc2

2. The policies are organized in the checkov_policies/ directory by provider and category.

To scan your Terraform code with these custom SOC2 policies:

checkov -d /path/to/terraform/code --external-checks-dir ./checkov_policies

For AWS only:

checkov -d /path/to/terraform/code --external-checks-dir ./checkov_policies --framework terraform --check-pattern "CKV_SOC2_AWS_.*"

For GCP only:

checkov -d /path/to/terraform/code --external-checks-dir ./checkov_policies --framework terraform --check-pattern "CKV_SOC2_GCP_.*"

For Azure only:

checkov -d /path/to/terraform/code --external-checks-dir ./checkov_policies --framework terraform --check-pattern "CKV_SOC2_AZURE_.*"

For DigitalOcean only:

checkov -d /path/to/terraform/code --external-checks-dir ./checkov_policies --framework terraform --check-pattern "CKV_SOC2_DO_.*"

Generate reports in different formats:

# JSON output
checkov -d /path/to/terraform --external-checks-dir ./checkov_policies -o json

# JUnit XML (for CI/CD integration)
checkov -d /path/to/terraform --external-checks-dir ./checkov_policies -o junitxml

# SARIF (for GitHub integration)
checkov -d /path/to/terraform --external-checks-dir ./checkov_policies -o sarif

name: SOC2 Compliance Check

on: [push, pull_request]

jobs:
  checkov:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2

      - name: Run Checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: terraform/
          external_checks_dir: checkov_policies
          framework: terraform
          output_format: sarif
          soft_fail: false

soc2-compliance:
  stage: test
  image: bridgecrew/checkov:latest
  script:
    - checkov -d terraform/ --external-checks-dir checkov_policies --framework terraform

See the examples/terraform/ directory for example Terraform configurations that pass and fail these policies.

To customize policies for your organization:

1. Edit the policy files in checkov_policies/
2. Adjust thresholds (e.g., backup retention days, password length)
3. Add new policies by creating new classes that inherit from BaseResourceCheck

Example custom policy:

from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
from checkov.common.models.enums import CheckResult, CheckCategories

class CustomSOC2Check(BaseResourceCheck):
    def __init__(self):
        name = "Your custom check description"
        id = "CKV_SOC2_CUSTOM_001"
        supported_resources = ['resource_type']
        categories = [CheckCategories.ENCRYPTION]
        guideline = "SOC2 guidance for this check"
        super().__init__(name=name, id=id, categories=categories,
                        supported_resources=supported_resources, guideline=guideline)

    def scan_resource_conf(self, conf, entity_type):
        # Your validation logic here
        if meets_requirements:
            return CheckResult.PASSED
        return CheckResult.FAILED

check_custom = CustomSOC2Check()

To suppress specific checks for valid exceptions:

resource "aws_s3_bucket" "public_bucket" {
  #checkov:skip=CKV_SOC2_AWS_001:This bucket is intentionally public for static website hosting
  bucket = "my-public-bucket"
}

Create .checkov.yml:

skip-check:
  - CKV_SOC2_AWS_001  # Skip S3 encryption check
  - CKV_SOC2_GCP_103  # Skip GCS public access check

To add new policies:

1. Create a new policy file or add to existing provider files
2. Follow the naming convention: {provider}_{category}_policies.py
3. Use policy IDs in the format: CKV_SOC2_{PROVIDER}_{CATEGORY_NUMBER}
4. Include clear descriptions and guidelines
5. Add examples to the examples directory

These policies map to SOC2 Trust Services Criteria:

• CC6.1 - Logical and Physical Access Controls → Access Control Policies
• CC6.6 - Encryption of Data → Encryption Policies
• CC6.7 - Transmission of Data → Network Security Policies
• CC7.2 - Detection of System Failures → Monitoring & Logging Policies
• A1.2 - Backup and Recovery → Backup Policies

MIT License - See LICENSE file for details

For issues or questions:

• Open an issue in the repository
• Review the examples directory
• Check Checkov documentation: https://www.checkov.io/

• Add support for Azure
• Include custom severity levels
• Add automated remediation suggestions
• Integrate with compliance frameworks (HIPAA, PCI-DSS)
• Add performance benchmarks