Originally published at sahildubey.us
Engineers think in AWS services; auditors think in controls. The gap between those two languages is where audits stall. After 16 years building AWS platforms and defending them in SOC 2, PCI DSS and ISO 27001 audits (I'm a CISA-certified auditor and AWS Solutions Architect Professional), here's how the core AWS building blocks map to the frameworks — and, just as important, the evidence each one has to produce.
The mapping
| AWS component | Satisfies (SOC 2 / PCI / ISO) | Evidence an auditor asks for |
|---|---|---|
| IAM + Identity Center + IRSA | CC6.1–6.3 / PCI 7,8 / A.9 | Access-review export, MFA policy, no long-lived keys |
| VPC + private subnets + SG/NACL | CC6.6 / PCI 1 / A.13 | Network diagram, SG rules, no 0.0.0.0/0 to sensitive ports |
| KMS + Secrets Manager | CC6.7 / PCI 3,4 / A.10 | Key policies, rotation config, encryption-at-rest proof |
| CloudTrail + Config + GuardDuty | CC7.2–7.3 / PCI 10 / A.12 | Log retention, tamper-evidence, alert routing |
| CodePipeline + Checkov/OPA gate | CC8.1 / PCI 6 / A.14 | Pipeline definition, failed-build evidence, change tickets |
| RDS + automated backups | A1.2 / PCI 10 / A.12 | Backup schedule, tested restore, RTO/RPO doc |
The failure modes
These are the patterns that actually fail audits:
- Long-lived access keys in CI instead of IRSA or OIDC.
- A public RDS endpoint or open SSH to 0.0.0.0/0.
- Hardcoded secrets and unmanaged encryption keys.
- Logging switched off in one region, so the trail has holes.
- Manual production changes with no pipeline gate or ticket.
From mapping to evidence
The point of the mapping isn't the table — it's that each row produces evidence automatically when the control is real. IAM Identity Center emits access reviews; the pipeline emits change records; Config emits drift. Wire those outputs into an evidence store and the audit stops being a scramble.
Does AWS give you compliance out of the box?
No. AWS provides compliant infrastructure under the shared-responsibility model, but you still have to configure and prove the controls in your own account. AWS being compliant does not make your workload compliant.
My take
One well-built AWS control set serves SOC 2, PCI DSS and ISO 27001 at once, because the frameworks overlap far more than they differ. Build the controls to satisfy the strictest requirement, map them to each framework, and you defend three audits with one platform.
I'm Sahil Dubey — DevOps, cloud & compliance architect (CISA, CISM, AWS SA Pro). More at sahildubey.us, including the full version of this piece with FAQ: AWS compliance controls mapping.
Top comments (0)