<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# SOC 2 Trust Criteria Auditing — API Reference

## Evidence Collection Commands

```bash
# CC6.1 — IAM and access controls
aws iam get-account-authorization-details --output json
aws iam generate-credential-report
aws iam get-credential-report --output json

# CC6.2 — User lifecycle events
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreateUser

# CC7.1 — Vulnerability findings
aws inspector2 list-findings --output json

# CC7.2 — Monitoring and alerting
aws cloudwatch describe-alarms --output json
aws guardduty list-findings --detector-id <ID>

# CC8.1 — Change management
gh pr list --state merged --limit 50 --json number,title,reviews,mergedAt
```

## InSpec SOC 2 Resources

```bash
# Run SOC 2 profile against AWS
inspec exec soc2-aws-profile -t aws:// --reporter json:/tmp/soc2.json

# Run specific criteria controls
inspec exec soc2-profile --controls soc2-cc6.1 soc2-cc7.2

# Check profile validity
inspec check soc2-profile
```

## Common Criteria Evidence Matrix

| Criteria | Evidence Type | Source | Frequency |
|----------|--------------|--------|-----------|
| CC6.1 | IAM config, MFA status | AWS IAM | Continuous |
| CC6.2 | Provisioning tickets | ITSM/Jira | Per event |
| CC6.3 | RBAC policy docs | IAM/IdP | Quarterly |
| CC7.1 | Vuln scan reports | Inspector/Qualys | Weekly |
| CC7.2 | SIEM alerts, logs | CloudTrail/SIEM | Continuous |
| CC7.4 | IR runbooks, postmortems | Wiki/Confluence | Per incident |
| CC8.1 | PR approvals, deploy logs | GitHub/CI-CD | Per change |
| CC9.1 | Vendor assessments | GRC platform | Annual |

## Compliance Platform APIs

```bash
# Vanta API — list controls
curl -H "Authorization: Bearer $VANTA_TOKEN" \
  https://api.vanta.com/v1/controls

# Drata API — compliance status
curl -H "Authorization: Bearer $DRATA_TOKEN" \
  https://public-api.drata.com/controls
```
