Automate SOC 2 Compliance for a Growing Startup

# .github/workflows/security-scan.yml
name: Security Scan
on: pull_request

jobs:
  semgrep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Semgrep SAST scan
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/security-audit
            p/secrets
            p/owasp-top-ten
            p/typescript
          generateSarif: true

      - name: Upload SARIF results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif

      # Fail PR if critical/high findings
      - name: Check for blocking findings
        run: |
          CRITICAL=$(cat semgrep.sarif | jq '[.runs[].results[] | select(.level == "error")] | length')
          if [ "$CRITICAL" -gt 0 ]; then
            echo "❌ $CRITICAL critical findings. Fix before merging."
            exit 1
          fi

  checkov:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Checkov IaC scan
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: ./infrastructure
          framework: terraform,dockerfile,kubernetes
          output_format: sarif
          soft_fail: false
          # SOC 2 relevant checks
          check: >-
            CKV_AWS_18,CKV_AWS_19,CKV_AWS_20,CKV_AWS_21,
            CKV_AWS_145,CKV_AWS_149,CKV_AWS_300

      # Generate compliance report
      - name: Compliance report
        run: |
          checkov -d ./infrastructure --framework terraform \
            --output json > /tmp/checkov-report.json

          # Store as audit artifact
          aws s3 cp /tmp/checkov-report.json \
            s3://audit-artifacts/checkov/$(date +%Y-%m-%d)/report.json

// lib/config.ts — All secrets from Infisical, never from env files
import { InfisicalClient } from "@infisical/sdk";

const infisical = new InfisicalClient({
  siteUrl: "https://vault.ourcompany.com",
  auth: { universalAuth: { clientId: process.env.INFISICAL_CLIENT_ID!, clientSecret: process.env.INFISICAL_CLIENT_SECRET! } },
});

export async function getSecrets() {
  const secrets = await infisical.listSecrets({
    environment: process.env.NODE_ENV === "production" ? "prod" : "dev",
    projectId: process.env.INFISICAL_PROJECT_ID!,
  });

  return {
    databaseUrl: secrets.find(s => s.secretName === "DATABASE_URL")!.secretValue,
    stripeKey: secrets.find(s => s.secretName === "STRIPE_SECRET_KEY")!.secretValue,
    jwtSecret: secrets.find(s => s.secretName === "JWT_SECRET")!.secretValue,
  };
}

// Infisical provides:
// - Audit log of every secret access (who, when, which secret)
// - Automatic rotation reminders
// - Secret versioning (rollback if rotation breaks something)
// - IP allowlisting (secrets only accessible from production IPs)

// scripts/access-audit.ts — Runs weekly via cron
// Generates evidence for SOC 2 access review controls

async function auditAccess() {
  const report: AuditReport = {
    date: new Date().toISOString(),
    findings: [],
    summary: { totalUsers: 0, activeUsers: 0, inactiveUsers: 0, excessivePermissions: 0 },
  };

  // Check GitHub org members
  const githubMembers = await octokit.orgs.listMembers({ org: "ourcompany" });
  const activeEmployees = await hr.getActiveEmployees();
  const activeEmails = new Set(activeEmployees.map(e => e.email));

  for (const member of githubMembers.data) {
    const profile = await octokit.users.getByUsername({ username: member.login });
    if (!activeEmails.has(profile.data.email)) {
      report.findings.push({
        severity: "high",
        type: "orphaned-account",
        detail: `GitHub user ${member.login} (${profile.data.email}) not found in active employee list`,
        recommendation: "Remove from GitHub organization",
      });
    }
  }

  // Check AWS IAM for excessive permissions
  const iamUsers = await iam.listUsers({}).promise();
  for (const user of iamUsers.Users) {
    const policies = await iam.listAttachedUserPolicies({ UserName: user.UserName }).promise();
    const hasAdmin = policies.AttachedPolicies.some(p => p.PolicyName === "AdministratorAccess");
    if (hasAdmin) {
      report.findings.push({
        severity: "medium",
        type: "excessive-permission",
        detail: `IAM user ${user.UserName} has AdministratorAccess`,
        recommendation: "Replace with least-privilege policy",
      });
      report.summary.excessivePermissions++;
    }
  }

  // Store report for auditor
  await s3.putObject({
    Bucket: "audit-artifacts",
    Key: `access-reviews/${new Date().toISOString().split("T")[0]}/report.json`,
    Body: JSON.stringify(report, null, 2),
  }).promise();

  // Alert on findings
  if (report.findings.some(f => f.severity === "high")) {
    await slack.send("#security", `⚠️ Access audit found ${report.findings.length} issues. Review: ${reportUrl}`);
  }

  return report;
}

// lib/monitoring.ts — Structured incident logging
import { trace, metrics } from "@opentelemetry/api";

const meter = metrics.getMeter("compliance");
const incidentCounter = meter.createCounter("security_incidents", {
  description: "Security incidents detected",
});

async function handleSecurityAlert(alert: SecurityAlert) {
  incidentCounter.add(1, { severity: alert.severity, type: alert.type });

  // Create incident record (SOC 2 requires documented incident response)
  const incident = await db.incidents.create({
    data: {
      alertId: alert.id,
      severity: alert.severity,
      type: alert.type,
      description: alert.description,
      status: "open",
      detectedAt: new Date(),
      assignedTo: getOnCallEngineer(),
    },
  });

  // Notify
  await slack.send("#incidents", {
    text: `🚨 Security incident INC-${incident.id}: ${alert.description}`,
    blocks: [
      { type: "section", text: { type: "mrkdwn", text: `*Severity:* ${alert.severity}\n*Type:* ${alert.type}\n*Assigned:* ${incident.assignedTo}` } },
      { type: "actions", elements: [
        { type: "button", text: { type: "plain_text", text: "Acknowledge" }, action_id: `ack-${incident.id}` },
      ] },
    ],
  });

  return incident;
}