Skip to main content

Compliance Controls Implementation for Auditors

This document provides detailed control implementation mappings for compliance auditors reviewing CloudForge CI deployments.

Testing Status​

Compliance Frameworks​

FrameworkStatusProduction TestedNotes
SOC 2✅ Fully TestedYesValidated in production environment
HIPAA⚠️ Not TestedNoConfiguration complete, awaiting validation
PCI-DSS⚠️ Not TestedNoConfiguration complete, awaiting validation
GDPR⚠️ Not TestedNoConfiguration complete, awaiting validation

Authentication Methods​

Authentication TypeStatusProduction TestedNotes
No Authentication✅ TestedYesBasic deployment without authentication
AWS Cognito⚠️ Not TestedNoConfiguration complete, awaiting validation
ALB-OIDC (Identity Center)⚠️ Not TestedNoConfiguration complete, awaiting validation
ALB-OIDC (Generic)⚠️ Not TestedNoConfiguration complete, awaiting validation

Note: Production testing has been completed only for infrastructure controls (encryption, monitoring, AWS Config, etc.) without authentication enabled. Authentication integrations (Cognito, Identity Center, OIDC) are implemented and ready for deployment but have not been validated in production environments.

Scope and Limitations​

What CloudForge CI Provides​

CloudForge CI provides infrastructure-level technical controls. This includes:

  • AWS infrastructure configuration (VPC, security groups, encryption)
  • Access control mechanisms (IAM, Cognito, OIDC)
  • Audit logging (CloudTrail, VPC Flow Logs, ALB logs)
  • Monitoring and alerting (CloudWatch, GuardDuty, AWS Config)
  • Encryption at rest and in transit
  • Automated remediation for configuration drift

What Organizations Must Provide​

To achieve compliance, organizations must also implement:

  • Policies and Procedures: Documented security policies, incident response procedures
  • Training Programs: Security awareness training for staff
  • Third-Party Audits: QSA assessment (PCI-DSS), CPA audit (SOC 2), DPA agreements (GDPR)
  • Application-Level Controls: Application security, code reviews, vulnerability scanning
  • Organizational Controls: HR processes, vendor management, business continuity planning
  • Evidence Collection: Documentation beyond automated infrastructure evidence

Configuration Validation Rules (alwaysLoad Framework)​

Overview​

Framework ID: CONFIG Priority: 1 (runs first) alwaysLoad: true (runs regardless of compliance frameworks specified) File: ConfigurationValidationRules.java

Purpose: Validates basic deployment configuration requirements before compliance-specific rules run. This framework catches common configuration errors that would cause deployment failures regardless of compliance requirements.

Validation Rules​

CONFIG-SUBDOMAIN-DOMAIN​

  • Requirement: Subdomain requires a parent domain
  • Validation: Fails if subdomain is specified without domain
  • Severity: FAIL (blocks deployment)
  • Example Violation: 
    {
      "subdomain": "app",
      "domain": ""  // ❌ FAIL: Subdomain requires parent domain
    }
  • Evidence: 18 test cases in compliance-test-matrix.csv
  • Test Coverage: All runtimes (EC2, Fargate), all profiles (DEV, STAGING, PRODUCTION), all frameworks

Rationale: A subdomain like "app.example.com" requires a parent domain "example.com" for DNS configuration. This is a fundamental infrastructure requirement.

CONFIG-OIDC-HTTPS​

  • Requirement: ALB OIDC authentication requires HTTPS
  • Validation: Fails if authMode=alb-oidc and enableSsl=false
  • Severity: FAIL (blocks deployment)
  • Example Violation: 
    {
      "authMode": "alb-oidc",
      "enableSsl": false  // ❌ FAIL: OIDC requires HTTPS
    }
  • Evidence: 20 test cases in compliance-test-matrix.csv
  • Test Coverage: All runtimes, all profiles, all frameworks

Rationale: OIDC authentication exchanges tokens over HTTP. Using OIDC without HTTPS would expose authentication tokens to network interception.

Design Pattern: alwaysLoad​

The alwaysLoad = true attribute ensures these basic validations run even for deployments that don't specify any compliance frameworks. This prevents common configuration errors in development environments.

Example: A developer deploying to DEV without compliance can still catch the subdomain/domain mismatch before wasting time on a failed deployment.

SOC 2 Controls Implementation ✅ Tested​

CC6.1: Logical and Physical Access Controls​

Implementation:

// File: cloudforge-api/src/main/java/com/cloudforgeci/api/core/security/ProductionSecurityProfileConfiguration.java
// Controls: IAM password policy, MFA enforcement, session management
ControlImplementationEvidence LocationCode ReferenceTesting Status
Password Complexity12-char minimum, complexity requirementsAWS Config Rule: iam-password-policySoc2Rules.java:45-89✅ Tested
Password Rotation90-day max ageAWS Config Rule: iam-password-policySoc2Rules.java:45-89✅ Tested
MFA Enforcement ⚠️Required for admin accessCognito User Pool settingsCognitoAuthenticationFactory.java:120-145⚠️ Not Tested
Session Timeout ⚠️12-hour max session durationCognito User Pool settingsCognitoAuthenticationFactory.java:150-165⚠️ Not Tested

Audit Evidence:

  • ✅ Tested: AWS Config compliance dashboard showing password policy compliance
  • ⚠️ Not Tested: Cognito User Pool configuration export
  • ⚠️ Not Tested: CloudTrail logs showing MFA-authenticated sessions

Note: IAM password policy controls are production-tested. Cognito-based authentication (MFA, session management) is implemented but not yet production-validated.

CC6.6: Network Security​

Implementation:

// File: cloudforge-api/src/main/java/com/cloudforgeci/api/network/VpcFactory.java
// Controls: Network segmentation, security groups, NACLs
ControlImplementationEvidence LocationCode Reference
Network SegmentationPrivate subnets for compute, public for ALBVPC configurationVpcFactory.java:80-150
Security GroupsLeast-privilege ingress/egress rulesSecurity Group resourcesVpcFactory.java:200-250
Encryption in TransitTLS 1.2+ for all external trafficALB HTTPS listenerAlbFactory.java:180-220

Audit Evidence:

  • VPC Flow Logs showing network traffic patterns
  • Security Group rules export
  • ACM certificate validation records

CC7.2: System Monitoring​

Implementation:

// File: cloudforge-api/src/main/java/com/cloudforgeci/api/observability/ComplianceFactory.java
// Controls: CloudTrail, AWS Config, automated evidence collection
ControlImplementationEvidence LocationCode Reference
Audit LoggingCloudTrail all API callsS3 bucket (retained 2 years)ComplianceFactory.java:145-220
Configuration MonitoringAWS Config RulesConfig compliance dashboardComplianceFactory.java:350-450
Automated RemediationSSM automation documentsConfig Remediation ActionsComplianceFactory.java:1850-1950
Evidence RetentionS3 lifecycle policiesS3 bucket lifecycle rulesComplianceFactory.java:2040-2154

Audit Evidence:

  • CloudTrail logs (2-year retention)
  • AWS Config compliance reports
  • S3 bucket lifecycle configuration

Auto-Start Feature (v2.0.6+): AWS Config Recorder automatically starts during deployment via custom resource, ensuring zero-gap compliance monitoring.

// ComplianceFactory.java:475-534
AwsSdkCall startRecorderCall = AwsSdkCall.builder()
    .service("ConfigService")
    .action("startConfigurationRecorder")
    .parameters(Map.of("ConfigurationRecorderName", "cloudforge-config-recorder"))
    .build();

Evidence: CloudTrail event StartConfigurationRecorder logged at deployment time.

HIPAA Controls Implementation ⚠️ Not Yet Tested​

§164.312(a)(2)(i): Unique User Identification ⚠️ Authentication Not Tested​

ControlImplementationEvidence LocationCode ReferenceTesting Status
Unique User IDs ⚠️Cognito User Pool with email-based authCognito User PoolCognitoAuthenticationFactory.java:85-110⚠️ Not Tested
MFA ⚠️TOTP + SMS for admin accessCognito MFA settingsCognitoAuthenticationFactory.java:120-145⚠️ Not Tested

Note: Cognito authentication is implemented but not production-tested. Use authMode: "cognito" and cognitoMfaEnabled: true to enable.

§164.312(a)(2)(iv): Encryption at Rest ✅ Tested​

ControlImplementationEvidence LocationCode ReferenceTesting Status
EFS EncryptionAES-256 encryption enabledEFS configurationEfsFactory.java:120-140✅ Tested
EBS EncryptionAES-256 encryption enabledEC2 launch templateEc2Factory.java:200-230✅ Tested
S3 EncryptionAES-256 SSE-S3 enabledS3 bucket configurationComplianceFactory.java:260-290✅ Tested

§164.312(b): Audit Controls ✅ Infrastructure Tested​

ControlImplementationEvidence LocationCode ReferenceTesting Status
Audit LogsCloudTrail all API callsS3 bucket (retained 6 years)ComplianceFactory.java:145-220✅ Tested
Log Retention6-year retention (2190 days)S3 lifecycle policyComplianceFactory.java:2040-2154✅ Tested

Configuration: Set logRetentionDays: 2190 and complianceFrameworks: "HIPAA"

Note: CloudTrail logging and retention tested. HIPAA-specific log analysis and reporting not yet validated.

PCI-DSS Controls Implementation ⚠️ Not Yet Tested​

Requirement 6.6: Web Application Firewall​

ControlImplementationEvidence LocationCode Reference
WAFAWS WAF v2 with managed rule groupsWAF WebACLWafFactory.java:80-150
SQL Injection ProtectionAWS Managed Rules - SQL DBWAF rule groupWafFactory.java:160-180
XSS ProtectionAWS Managed Rules - CoreWAF rule groupWafFactory.java:185-205

Configuration: Set wafEnabled: true

Requirement 10.2: Audit Trail​

ControlImplementationEvidence LocationCode Reference
Access LogsALB access logs to S3S3 bucket (1-year retention)AlbFactory.java:250-280
API Audit LogsCloudTrail all API callsS3 bucket (1-year retention)ComplianceFactory.java:145-220

Configuration: Set albAccessLogging: true, logRetentionDays: 365

Requirement 11.4: Intrusion Detection​

ControlImplementationEvidence LocationCode Reference
Threat DetectionGuardDuty monitoringGuardDuty findingsGuardDutyFactory.java:54-97
Auto-StartCustom resource enables GuardDutyCloudFormation custom resourceGuardDutyFactory.java:73-97

Configuration: Set guardDutyEnabled: true (auto-enabled with PRODUCTION security profile)

Evidence: GuardDuty findings dashboard, EventBridge rules for alerting

GDPR Controls Implementation ⚠️ Not Yet Tested​

Article 25: Data Protection by Design​

ControlImplementationEvidence LocationCode Reference
Encryption by DefaultAll storage encryptedEFS, EBS, S3 encryptionMultiple factories
Minimal Data CollectionNo PII in CloudTrail/ConfigAWS service configurationN/A

Article 30: Records of Processing Activities​

ControlImplementationEvidence LocationCode Reference
Audit LogsCloudTrail all API callsS3 bucket (2-year retention)ComplianceFactory.java:145-220
Processing RecordsCloudTrail logs document all data processingCloudTrail S3 bucketComplianceFactory.java:145-220

Article 32: Security of Processing​

ControlImplementationEvidence LocationCode Reference
EncryptionAES-256 at rest, TLS 1.2+ in transitMultiple resourcesMultiple factories
Access ControlIAM, Cognito, security groupsIAM policies, Cognito configMultiple factories
MonitoringCloudWatch, AWS Config, GuardDutyMonitoring dashboardsSecurityMonitoringFactory.java

Configuration: Set region: "eu-west-1" for EU data residency

Cross-Framework Control Mapping​

Encryption at Rest ✅ Tested​

FrameworkRequirementImplementationEvidenceTesting Status
SOC 2CC6.1AES-256 for EFS, EBS, S3AWS Config Rules✅ Tested
HIPAA§164.312(a)(2)(iv)AES-256 for EFS, EBS, S3AWS Config Rules✅ Tested
PCI-DSSReq 3.4AES-256 for EFS, EBS, S3AWS Config Rules✅ Tested
GDPRArt. 32(1)(a)AES-256 for EFS, EBS, S3AWS Config Rules✅ Tested

Code: EfsFactory.java:120-140, Ec2Factory.java:200-230, ComplianceFactory.java:260-290

Access Control ⚠️ Authentication Not Tested​

FrameworkRequirementImplementationEvidenceTesting Status
SOC 2CC6.2IAM policies ✅, Cognito MFA ⚠️IAM policy docs, Cognito configPartial
HIPAA§164.312(a)(1)IAM policies ✅, Cognito MFA ⚠️IAM policy docs, Cognito configPartial
PCI-DSSReq 7.1-7.2IAM policies ✅, Cognito MFA ⚠️IAM policy docs, Cognito configPartial
GDPRArt. 25(2)IAM policies ✅, Cognito MFA ⚠️IAM policy docs, Cognito configPartial

Code: CognitoAuthenticationFactory.java:85-165

Note: IAM password policies are production-tested via AWS Config. Cognito MFA, Identity Center, and OIDC authentication are implemented but not production-tested.

Audit Logging ✅ Tested​

FrameworkRequirementRetention PeriodImplementationTesting Status
SOC 2CC7.22 yearsCloudTrail + lifecycle✅ Tested
HIPAA§164.312(b)6 yearsCloudTrail + lifecycle✅ Tested
PCI-DSSReq 10.71 yearCloudTrail + lifecycle✅ Tested
GDPRArt. 302 yearsCloudTrail + lifecycle✅ Tested

Code: ComplianceFactory.java:145-220 (CloudTrail), ComplianceFactory.java:2040-2154 (Lifecycle)

Note: CloudTrail logging, S3 lifecycle policies, and log retention are production-tested.

Automated Evidence Collection​

AWS Audit Manager Integration​

When auditManagerEnabled: true, the system creates one assessment per framework:

{
  "complianceFrameworks": "SOC2,HIPAA,PCI-DSS"
}

Creates:

  • SOC 2 Type 2 assessment
  • HIPAA assessment
  • PCI-DSS v3.2.1 assessment

Evidence Sources:

  • CloudTrail API logs
  • AWS Config compliance data
  • GuardDuty findings
  • WAF logs
  • VPC Flow Logs
  • ALB access logs

Assessment Lifecycle:

  • Created automatically via CloudFormation
  • Visible in AWS Audit Manager console
  • Deleted when stack is destroyed (evidence retained in S3)

Compliance Reports for Auditors​

How to Generate Evidence​

  1. AWS Config Compliance Dashboard

    aws configservice describe-compliance-by-config-rule \
      --region us-east-1 \
      --output table

  2. Audit Manager Assessment Export

    aws auditmanager get-assessment \
      --assessment-id <assessment-id> \
      --region us-east-1

  3. CloudTrail Log Analysis

    aws s3 sync s3://cloudforge-cloudtrail-<account-id>/ ./audit-logs/

  4. Security Hub Compliance Score

    aws securityhub get-findings \
      --filters '{"ComplianceStatus":[{"Value":"FAILED","Comparison":"EQUALS"}]}' \
      --region us-east-1

Pre-Generated Reports​

CloudForge CI GitHub Pages includes:

  • Validation Reports: Truth tables showing all tested configurations
  • Coverage Reports: JaCoCo test coverage for all code
  • Vulnerability Scans: OWASP Dependency-Check reports
  • SBOM: Software Bill of Materials (JSON/XML)

URL: https://cloudforgeci.github.io/cfc-core/

Contact for Audit Support​

For audit support or questions about control implementation:

Last Updated: 2025-11-18 Document Version: 1.0 Scope: Infrastructure controls only - organizational controls are customer responsibility