The SOC 2 Audit Standard Practice Compliance Pack in Cloud Config evaluates your Alibaba Cloud resource configurations against controls defined in the SOC 2 trust services criteria. Use this compliance pack to continuously monitor whether your cloud environment meets the data security, availability, processing integrity, confidentiality, and privacy requirements of a SOC 2 audit.
Overview
Cloud Config provides compliance packs that bundle managed rules into logical groups for scenario-based compliance assessment. The SOC 2 Audit Standard Practice Compliance Pack contains 88 built-in rules that check your Alibaba Cloud resource configurations against the SOC 2 trust services criteria.
SOC 2 was developed by the American Institute of CPAs (AICPA) and defines controls relevant to five trust services categories:
| Category | Description |
| Security | Protection against unauthorized access to systems and data |
| Availability | Systems are available for operation and use as committed |
| Processing Integrity | System processing is complete, valid, accurate, timely, and authorized |
| Confidentiality | Information designated as confidential is protected |
| Privacy | Personal information is collected, used, retained, disclosed, and disposed of in conformity with commitments |
Each rule in this compliance pack maps to one or more SOC 2 criteria identified by standard codes. The following codes appear in the rule tables:
| Code | Category | Focus |
| A1.2 | Availability | Environmental protections, data backup, and recovery infrastructure |
| C1.1 | Confidentiality | Identification and maintenance of confidential information |
| C1.2 | Confidentiality | Disposal of confidential information |
| CC1.3 | Control Environment | Management structures, reporting lines, and authorities |
| CC3.1 | Risk Assessment | Specification of objectives for risk identification |
| CC3.2 | Risk Assessment | Risk identification and analysis as a basis for risk management |
| CC6.1 | Logical Access | Logical access security for protected information assets |
| CC6.2 | Logical Access | System credentials and user access authorization |
| CC6.3 | Logical Access | Role-based access, least privilege, and segregation of duties |
| CC6.6 | Logical Access | Protection against external threats |
| CC6.7 | Logical Access | Transmission, movement, and removal of information |
| CC6.8 | Logical Access | Prevention or detection of unauthorized or malicious software |
| CC7.1 | Monitoring | Detection and monitoring of configuration changes and vulnerabilities |
| CC7.2 | Monitoring | Monitoring system components for anomalies |
| CC7.3 | Monitoring | Evaluation of security events and incident determination |
| CC7.4 | Monitoring | Incident response program for security incidents |
The 88 rules are organized into six security domains in the following sections. Each domain section lists the rules that apply to that area, with the rule description, compliance condition, and applicable SOC 2 criteria.
Data backup and recovery
The following rules check whether backup and recovery configurations are in place for your Alibaba Cloud services to meet SOC 2 availability and incident recovery objectives.
| Rule name | Rule description | SOC 2 criteria |
| Enable log backup for RDS instances | An RDS instance is compliant if log backup is enabled. | A1.2, CC7.4 |
| Create a backup plan for NAS file systems | A NAS file system is compliant if a backup plan is created for it. | A1.2, CC7.4 |
| Enable zone-redundant storage for OSS buckets | An OSS bucket is compliant if zone-redundant storage is enabled. If zone-redundant storage is disabled, OSS cannot provide consistent service when a data center becomes unavailable, which affects your data recovery objective. | A1.2, CC7.4 |
| The retention period of level-1 backups for PolarDB clusters meets the specified requirement | A PolarDB cluster is compliant if the retention period of its level-1 backups is greater than or equal to the specified number of days. Default value: 7 days. | A1.2, CC7.4 |
Access control and identity management
The following rules check whether identity, access, and permission configurations follow the principles of least privilege and segregation of duties.
| Rule name | Rule description | SOC 2 criteria |
| RAM user groups are not empty | A RAM user group is compliant if it contains at least one RAM user. | CC1.3, CC6.2, CC6.3 |
| No idle RAM user groups exist | A RAM user group is compliant if it contains at least one RAM user and at least one RAM access policy is attached to it. | CC1.3, CC6.2, CC6.3 |
| No idle RAM access policies exist | A RAM access policy is compliant if it is attached to at least one RAM user group, RAM role, or RAM user. | CC1.3 |
| No super administrators exist | Your account is compliant if no RAM user, RAM user group, or RAM role has super administrator permissions, in which Resource is set to * and Action is set to *. | CC1.3, CC6.1, CC6.2, CC6.3 |
| Enable MFA for RAM users | A RAM user that has console access is compliant if multi-factor authentication (MFA) is enabled in its logon settings. | CC3.2, CC6.3, CC6.6 |
| The Alibaba Cloud account has no AccessKey | An Alibaba Cloud account is compliant if it has no AccessKey in any state. | CC6.1, CC6.2, CC6.3 |
| Rotate the AccessKey of RAM users within the specified period | A RAM user AccessKey is compliant if the period between its creation and the check does not exceed the specified number of days. Default value: 90 days. | CC6.1, CC6.2, CC6.3 |
| The RAM user password policy meets requirements | A RAM user password policy is compliant if all its settings meet the values specified by the parameters. | CC6.1, CC6.3 |
| Separate personnel access from program access for RAM users | A RAM user is compliant if console access and API access are not both enabled. | CC6.2, CC6.3 |
| Do not attach access policies directly to RAM users | A RAM user is compliant if no access policy is directly attached to it. We recommend that RAM users inherit permissions from RAM user groups or RAM roles. | CC6.2, CC6.3 |
| RAM users belong to RAM user groups | Your account is compliant if all RAM users belong to a RAM user group. | CC6.2, CC6.3 |
| RAM users have no AccessKey in the Active state | A RAM user is compliant if it has no AccessKey in the Active state. | CC6.2, CC6.3 |
| Install the ack-ram-authenticator component in ACK clusters to authenticate requests based on RAM | An ACK cluster is compliant if the ack-ram-authenticator component is installed to enable RAM-based authentication. | CC6.3 |
| Instance RAM roles are attached to ECS instances | An ECS instance is compliant if an instance RAM role is attached to it. | CC6.3 |
| Enable deletion protection for RDS instances | An RDS instance is compliant if deletion protection is enabled. This rule is not applicable to subscription instances, because they do not support deletion protection. | C1.1 |
| Enable deletion protection for PolarDB clusters | A PolarDB cluster is compliant if deletion protection is enabled. This rule is not applicable to subscription clusters. | C1.1 |
| Enable deletion protection for KMS master keys | A KMS master key is compliant if deletion protection is enabled. This rule is not applicable to keys that are not in the Enabled state, or to service keys, because service keys cannot be deleted. | C1.1 |
| Configure automatic rotation for secrets in Key Management Service | A secret in Key Management Service (KMS) is compliant if automatic rotation is configured. This rule is not applicable to generic secrets. | CC6.1, CC6.2 |
| KMS secrets are rotated successfully | A KMS secret is compliant if automatic rotation is enabled and the secret is rotated successfully based on the configured rotation period. This rule is not applicable to generic secrets, because KMS does not support periodic rotation for them. | CC6.1 |
| KMS master keys are not pending deletion | A KMS master key is compliant if it is not pending deletion. | CC6.1 |
| Enable TDE encryption for RDS instances | An RDS instance is compliant if Transparent Data Encryption (TDE) is enabled in its data security settings. This rule is not applicable to instance types or versions that do not support TDE. | CC6.1, CC6.2 |
Network security
The following rules check whether network exposure, transport encryption, and perimeter defense configurations meet SOC 2 logical access and data transmission requirements.
| Rule name | Rule description | SOC 2 criteria |
| Running ECS instances are not associated with public IP addresses | A running ECS instance is compliant if it is not directly associated with an IPv4 public IP address or an elastic IP address (EIP). | CC6.1, CC6.6 |
| Running ECS instances reside in a VPC | Alibaba Cloud recommends that you deploy ECS instances in a VPC. An ECS instance is compliant if it belongs to a VPC. If you specify parameters, the instance is compliant only if its VPC is within the specified range. This rule is not applicable to instances that are not in the Running state. | CC6.1, CC6.6 |
| Do not associate public IP addresses with ECS instances | An ECS instance is compliant if it is not directly associated with an IPv4 public IP address or an EIP. | CC6.7 |
| SLB instances are not associated with public IP addresses | An SLB instance is compliant if no public IP address is associated with it. If you do not need public network access, do not associate a public IP address directly with an SLB instance. If you need public network access, purchase an EIP and associate it with the SLB instance. EIPs are more flexible and let you use shared bandwidth to reduce costs. | CC6.6 |
| Disable public network access for Function Compute services | A Function Compute service is compliant if public network access is disabled. | CC6.1 |
| Function services allow calls only from the specified VPCs | A function service is compliant if it allows calls only from the specified VPCs. | CC6.1, CC6.6 |
| ADB clusters do not have public network access enabled | An ADB instance is compliant if public network access is disabled. | CC6.1 |
| Elasticsearch instances do not have public network access enabled | An Elasticsearch instance is compliant if public network access is disabled. | CC6.1, CC6.6 |
| Container Registry instances do not have a public endpoint enabled | A Container Registry instance is compliant if no public endpoint is enabled. This rule applies to Enterprise Edition instances. | CC6.7 |
| Do not configure a public endpoint for RDS instances | An RDS instance is compliant if no public endpoint is configured. Do not configure Direct Internet Access for RDS instances in production environments, because such instances are vulnerable to attacks. | CC6.1, CC6.6 |
| All endpoints of PolarDB clusters have public access disabled | A PolarDB cluster is compliant if public access is disabled for all its endpoints. | CC6.1, CC6.6 |
| The IP whitelist of PolarDB instances is not set to all CIDR blocks | A PolarDB instance is compliant if its IP whitelist is not set to 0.0.0.0/0. | CC6.1 |
| Inbound rules of security groups are valid for ports that are not on the whitelist | A security group is compliant if no inbound rule allows access from 0.0.0.0/0 on ports other than the specified whitelist ports. This rule is not applicable to security groups that are used by Alibaba Cloud services or resellers. | CC6.1, CC6.6 |
| Security groups do not open risky ports of the specified protocol to all CIDR blocks | A security group is compliant if the port range of the specified protocol does not contain the specified risky ports when the inbound CIDR block is set to 0.0.0.0/0. If the inbound CIDR block is not set to 0.0.0.0/0, the security group is compliant even if the port range contains the specified risky ports. The security group is also compliant if the detected risky ports are denied by an authorization policy that has a higher priority. This rule is not applicable to security groups that are used by Alibaba Cloud services or resellers. | CC6.1, CC6.6, CC7.2 |
| Scaling configurations do not assign public IPv4 addresses | A scaling configuration in Auto Scaling is compliant if it does not assign public IPv4 addresses. | CC6.6 |
| Detect idle elastic IP addresses | An elastic IP address (EIP) is compliant if it is associated with an ECS or NAT Gateway instance, which means that the EIP is not idle. | CC6.2 |
| NAT Gateway does not map the specified risky ports | A NAT Gateway is compliant if its DNAT entries do not map the specified risky ports. | CC6.6 |
| Enable flow log records for VPCs | A VPC is compliant if flow log recording is enabled. | CC3.2, CC6.6, CC7.3 |
| Enable HTTPS listeners for SLB instances | An SLB instance is compliant if an HTTPS listener is configured on the specified port. This rule is not applicable to instances that have only TCP or UDP listeners. | CC6.1, CC6.7 |
| Configure header removal for the HTTP listeners of ALB instances | An HTTP listener that is running on an ALB instance is compliant if a forwarding action that removes headers is configured. | CC6.1, CC6.7 |
| Elasticsearch instances use the HTTPS transport protocol | An Elasticsearch instance is compliant if it uses the HTTPS transport protocol. | CC6.1, CC6.7 |
| Configure secure access in OSS bucket policies | An OSS bucket is compliant if its bucket policy sets the access method of read and write operations to HTTPS, or sets the access method of denied access to HTTP. This rule is not applicable to buckets that have no bucket policy. | CC6.1, CC6.7 |
| SSL certificate expiration check | An SSL certificate is compliant if the number of days remaining before it expires is greater than the specified number of days. Default value: 30 days. | CC6.1, CC6.7 |
| SLB instances use certificates that are issued by Alibaba Cloud | An SLB instance is compliant if the certificate that it uses is issued by Alibaba Cloud. | CC6.7 |
| The HTTPS listeners of SLB instances use the specified security policy suite | An SLB instance is compliant if all its HTTPS listeners use the version of the security policy suite that is specified by the parameters. This rule is not applicable to instances that have no HTTPS listeners. | CC6.7 |
| SSL certificates are configured for the custom domains of API groups in API Gateway | An API group in API Gateway is compliant if a custom domain is bound to it and an SSL certificate is configured for the domain. | CC6.7 |
| Enable TLS or SSL encryption for Redis instances | A Redis instance is compliant if TLS or SSL encryption is enabled. | CC6.7 |
| Check whether TLS 1.3 is enabled for CDN domains | A CDN domain is compliant if TLS 1.3 is enabled. | CC6.7 |
| Synchronization tasks of DTS instances use SSL to connect to the source and destination databases | A DTS instance is compliant if all its synchronization tasks use SSL-encrypted connections for both the source and destination databases. This rule is not applicable to DTS instances whose task type is not synchronization. | CC6.7 |
| Enable SSL encryption for PolarDB clusters | A PolarDB cluster is compliant if Secure Sockets Layer (SSL) encryption is enabled. | CC6.7 |
| Enable TDE for PolarDB clusters | A PolarDB cluster is compliant if TDE is enabled. | CC6.6 |
| Domains that are bound to API groups in API Gateway are added to WAF or WAF 3.0 | An API group in API Gateway is compliant if the domain that is bound to it is added to WAF or WAF 3.0. | CC6.6 |
| Configure security authentication for APIs in API Gateway | An API in API Gateway is compliant if its security authentication method is set to Alibaba Cloud App or if it uses a specified plug-in type. | CC6.6 |
Threat protection
The following rules check whether threat detection, vulnerability management, and security agent coverage meet SOC 2 risk assessment and malicious software prevention requirements.
| Rule name | Rule description | SOC 2 criteria |
| Use Security Center Enterprise Edition | Your account is compliant if you use Security Center Enterprise Edition or a higher edition. | CC3.1, CC6.6, CC6.8, CC7.1, CC7.2, CC7.3, CC7.4 |
| Enable protection for assets in Cloud Firewall | An asset is compliant if protection is enabled for it in Cloud Firewall. This rule applies only to paid Cloud Firewall users. No detection data is available for the assets of users who have not activated Cloud Firewall or who use the free edition. | CC3.1, CC6.1, CC6.6, CC6.8 |
| Configure vulnerability scanning at the specified levels in Security Center | Your configuration is compliant if vulnerability scanning is configured in Security Center for the specified risk levels. | CC3.1, CC6.1, CC6.6, CC6.8 |
| Enable the specified types of proactive defense in Security Center | Your configuration is compliant if the types of proactive defense that are specified by the parameters are enabled in Security Center. | CC3.1, CC6.1, CC6.6, CC6.8 |
| Enable the specified protection rules for WAF 3.0 instances | A WAF 3.0 instance is compliant if protection rules are enabled for the specified protection scenarios. | CC3.1, CC6.1, CC6.6, CC6.8 |
| Enable Security Center protection for running ECS instances | The Security Center agent provides security protection for hosts. A running ECS instance is compliant if the Security Center agent is installed. This rule is not applicable to instances that are not in the Running state. | CC3.2, CC6.1, CC7.1 |
| Install the Cloud Monitor agent on running ECS instances | A running ECS instance is compliant if the Cloud Monitor agent is installed and the agent is running. This rule is not applicable to instances that are not in the Running state. | CC3.2, CC7.1, CC7.2, CC7.3 |
| Install the Cloud Monitor agent on running nodes in ACK clusters | An ACK cluster is compliant if the Cloud Monitor agent is installed on all its running nodes and the monitoring status is normal. | CC3.2, CC7.2 |
| Running ECS instances have no vulnerabilities to fix | An ECS instance is compliant if Security Center detects no vulnerabilities of the specified types and severity levels that need to be fixed. This rule is not applicable to instances that are not in the Running state. | CC6.6, CC6.8, CC7.1, CC7.3 |
| The Security Center agent is installed on all ECS instances in the account | Your account is compliant if the Security Center agent is installed on all ECS instances. | CC6.6 |
| Security Center has no image vulnerabilities to fix | Your account is compliant if image scanning is enabled in Security Center and no image vulnerabilities need to be fixed. This rule is not applicable if image scanning is not enabled or has not been run, because no vulnerability information is available. | CC6.8, CC7.1 |
| The Cloud Monitor agent is installed on the nodes of ACK clusters | An ACK cluster is compliant if the Cloud Monitor agent is installed on all its nodes and the agent is running. | CC7.1 |
Monitoring and audit
The following rules check whether logging, monitoring, and alerting configurations provide sufficient audit trails and anomaly detection for SOC 2 monitoring and incident response requirements.
| Rule name | Rule description | SOC 2 criteria |
| Enable full log tracking in ActionTrail | Your account is compliant if ActionTrail contains an enabled trail that covers all regions and all event types. A member account in a resource directory is also compliant if the administrator created a trail that applies to all member accounts. | A1.2, CC3.2, CC7.1, CC7.2 |
| Configure notification methods for Security Center notification items | Security Center is compliant if notification methods are configured for all notification items. | A1.2 |
| Configure call log storage for API groups | An API group in API Gateway is compliant if call log storage is configured. | A1.2, CC7.2, CC7.3 |
| Enable access logs for SLB instances | A Classic Load Balancer (CLB) instance is compliant if access logs are enabled. This rule is not applicable to instances that have no Layer 7 listeners, because such instances do not support access logs. | A1.2, CC3.2, CC7.2, CC7.3 |
| Enable log backup for ADB clusters | An ADB cluster is compliant if log backup is enabled. | A1.2, CC7.4 |
| Configure an automatic snapshot policy for ECS disks | An ECS disk is compliant if an automatic snapshot policy is configured. | CC7.4 |
| Configure Cloud Monitor alert rules for the specified cloud services | Your account is compliant if at least one alert rule is configured in Cloud Monitor for the cloud service in the specified namespace. | CC7.2, CC7.3, CC7.4 |
| Enable SQL audit logs for ADB clusters | An ADB cluster is compliant if SQL audit logging is enabled. | CC7.3 |
| Enable SQL audit for PolarDB clusters | A PolarDB cluster is compliant if SQL audit is enabled. | CC7.4 |
Encryption and data protection
The following rules check whether encryption is enabled for data at rest and in transit across your Alibaba Cloud services to meet SOC 2 logical access and data protection requirements.
| Rule name | Rule description | SOC 2 criteria |
| Enable server-side encryption for OSS buckets | An OSS bucket is compliant if server-side encryption with OSS-managed keys is enabled. | CC6.1 |
| Enable encryption for ECS data disks | An ECS data disk is compliant if encryption is enabled. | CC6.1 |
| Enable encryption for NAS file systems | A NAS file system is compliant if encryption is enabled. | CC6.1 |
| Enable disk encryption for the data nodes of Elasticsearch instances | A data node of an Elasticsearch instance is compliant if disk encryption is enabled. | CC6.1 |
| Enable versioning for OSS buckets | An OSS bucket is compliant if versioning is enabled. If versioning is disabled, you cannot restore data after it is overwritten or deleted. | A1.2, C1.1, C1.2, CC7.4 |
| OSS bucket ACLs prohibit public read access | An OSS bucket is compliant if its ACL prohibits public read access. | CC6.1 |
| OSS bucket ACLs prohibit public read and write access | An OSS bucket is compliant if its ACL prohibits public read and write access. | CC6.1 |
| Enable log storage for OSS buckets | An OSS bucket is compliant if log storage is enabled in Log Management. | CC6.1, CC7.2, CC7.3 |
| Function settings in Function Compute meet the specified requirements | A function in Function Compute 2.0 is compliant if its settings meet the requirements that are specified by the parameters. | CC7.2 |