# =============================================================================
# SOC2 Type II Compliance Controls Mapping
# =============================================================================
# Maps platform components to SOC2 trust service criteria

controls:
  # --- CC6: Security ---
  CC6.1:
    description: "Logical and physical access controls"
    implemented_by:
      - terraform/modules/iam  # IAM roles with MFA requirement
      - terraform/modules/vpc  # VPC isolation, flow logs
      - k8s/base/rbac          # Kubernetes RBAC
      - k8s/base/network-policies  # Network segmentation
    evidence:
      - IAM access logs (CloudTrail)
      - VPC flow logs (S3)
      - RBAC audit logs (EKS)

  CC6.2:
    description: "Authentication and authorization"
    implemented_by:
      - k8s/manifests/external-secrets  # OIDC-based secret access
      - terraform/modules/iam            # MFA enforcement
    evidence:
      - OIDC token audit logs
      - MFA configuration records

  CC6.3:
    description: "Encryption of data at rest"
    implemented_by:
      - terraform/modules/kms  # KMS key rotation
      - terraform/modules/rds  # RDS encryption
      - terraform/modules/s3   # S3 SSE-KMS
      - k8s/manifests/external-secrets  # EKS secret encryption
    evidence:
      - KMS key rotation logs
      - RDS encryption config
      - S3 bucket policies

  CC6.6:
    description: "Encryption of data in transit"
    implemented_by:
      - k8s/manifests/istio         # mTLS enforcement
      - k8s/manifests/cert-manager   # TLS cert automation
    evidence:
      - mTLS policy (PeerAuthentication)
      - Certificate issuance logs

  CC6.8:
    description: "Vulnerability management"
    implemented_by:
      - k8s/manifests/trivy-operator  # Continuous scanning
      - security/trivy                # Image scanning
      - ci-cd/github-actions          # Pipeline scanning
    evidence:
      - Trivy scan reports
      - CVE remediation SLA tracking

  # --- CC7: Availability ---
  CC7.1:
    description: "System availability monitoring"
    implemented_by:
      - monitoring/prometheus   # Alerting rules
      - monitoring/grafana      # Dashboards
      - monitoring/otel         # Distributed tracing
    evidence:
      - Uptime SLO reports
      - Incident post-mortems

  CC7.2:
    description: "Disaster recovery"
    implemented_by:
      - terraform/modules/rds  # Multi-AZ RDS
      - terraform/modules/eks  # Multi-AZ EKS
    evidence:
      - DR test results (quarterly)
      - RTO/RPO measurements

  # --- CC8: Processing Integrity ---
  CC8.1:
    description: "Change management"
    implemented_by:
      - k8s/manifests/argo-cd    # GitOps deployments
      - ci-cd/github-actions      # CI/CD pipeline
    evidence:
      - PR approval records
      - Deployment audit trail

  # --- CC9: Confidentiality ---
  CC9.1:
    description: "Data classification and handling"
    implemented_by:
      - k8s/manifests/external-secrets  # Secrets management
      - k8s/manifests/kyverno           # Policy enforcement
    evidence:
      - Data classification policy
      - Secret rotation logs