AWS compliance controls mapping: services to SOC 2, PCI & ISO
Engineers think in services; auditors think in controls. Here's how the core AWS building blocks map to SOC 2, PCI DSS and ISO 27001 - and the evidence each one produces.
Why this mapping matters
Engineers think in AWS services; auditors think in controls. The gap between those two languages is where audits stall. This is how the core AWS building blocks map to SOC 2, PCI DSS and ISO 27001 — and, just as important, the evidence each one has to produce.
The mapping
| AWS component | Satisfies (SOC 2 / PCI / ISO) | Evidence an auditor asks for |
|---|---|---|
| IAM + Identity Center + IRSA | CC6.1–6.3 / PCI 7,8 / A.9 | Access-review export, MFA policy, no long-lived keys |
| VPC + private subnets + SG/NACL | CC6.6 / PCI 1 / A.13 | Network diagram, SG rules, no 0.0.0.0/0 to sensitive ports |
| KMS + Secrets Manager | CC6.7 / PCI 3,4 / A.10 | Key policies, rotation config, encryption-at-rest proof |
| CloudTrail + Config + GuardDuty | CC7.2–7.3 / PCI 10 / A.12 | Log retention, tamper-evidence, alert routing |
| CodePipeline + Checkov/OPA gate | CC8.1 / PCI 6 / A.14 | Pipeline definition, failed-build evidence, change tickets |
| RDS + automated backups | A1.2 / PCI 10 / A.12 | Backup schedule, tested restore, RTO/RPO doc |
The failure modes
- Long-lived access keys in CI instead of IRSA or OIDC.
- A public RDS endpoint or open SSH to 0.0.0.0/0.
- Hardcoded secrets and unmanaged encryption keys.
- Logging switched off in one region, so the trail has holes.
- Manual production changes with no pipeline gate or ticket.
From mapping to evidence
The point of the mapping isn't the table — it's that each row produces evidence automatically when the control is real. IAM Identity Center emits access reviews; the pipeline emits change records; Config emits drift. Wire those outputs into an evidence store and the audit stops being a scramble.
My take
One well-built AWS control set serves SOC 2, PCI DSS and ISO 27001 at once, because the frameworks overlap far more than they differ. Build the controls to satisfy the strictest requirement, map them to each framework, and you defend three audits with one platform.
Want your services mapped to your framework?
I'll map your AWS architecture to your target controls and show you exactly what evidence each piece must produce.
DevOps & Compliance →Book a free call