Production-ready, SOC 2 Type II compliant infrastructure-as-code for AWS.
Quick Start • SOC 2 Compliance • Deployment Guide • Contributing
A complete, hardened VPC environment with:
- Network — VPC with public/private subnets across 2 AZs, NAT Gateways, Internet Gateway
- Compute — Auto-scaling web app instances in private subnets, bastion host for SSH access
- Load Balancer — Application Load Balancer with HTTPS (TLS 1.3), automatic HTTP-to-HTTPS redirect
- Database — Aurora MySQL Serverless v2 (encrypted at rest and in transit, 35-day backups, deletion protection)
- Storage — Encrypted EFS with automatic backups and mount targets in both AZs
- Monitoring — VPC Flow Logs, CloudTrail with encrypted S3 storage, CloudWatch alarms
- Security — Least-privilege IAM roles, scoped KMS keys with rotation, IMDSv2 enforcement, restricted security groups
Internet ──▶ ALB (HTTPS) ──▶ Web App (private subnet, auto-scaling 2-4)
│
├──▶ Aurora MySQL (private, encrypted, TLS enforced)
└──▶ EFS (private, encrypted, backups enabled)
Your IP ──▶ Bastion (restricted SSH) ──▶ Web App / DB tunnel
| Template | Description | Use Case |
|---|---|---|
cloudformation-launchtemplates-soc2.yaml |
SOC 2 Type II compliant | Recommended for production |
cloudformation-launchtemplates.yaml |
Standard (hardened) | Non-regulated environments |
cloudformation-template.yaml |
Legacy (Launch Configurations) | Deprecated — do not use |
You need two things before deploying:
- SSL Certificate — Go to AWS Certificate Manager, request a certificate for your domain, complete DNS validation, and copy the ARN
- EC2 Key Pair — Go to EC2 > Key Pairs, create one, and save the
.pemfile
- Go to CloudFormation > Create Stack
- Upload
cloudformation-launchtemplates-soc2.yaml - Fill in Section 1 (4 required fields: SSL cert ARN, key pair, database password, your IP for SSH)
- Review defaults in Sections 2-5 (all have sensible defaults)
- Check the IAM acknowledgment box and create the stack
aws cloudformation create-stack \
--stack-name my-web-app \
--template-body file://vpc-standard-2privatesubnets/cloudformation-launchtemplates-soc2.yaml \
--parameters \
ParameterKey=SSLCertificateArn,ParameterValue=arn:aws:acm:us-east-1:123456789:certificate/abc-123 \
ParameterKey=KeyPair,ParameterValue=my-key-pair \
ParameterKey=DBMasterUserPassword,ParameterValue='MyP@ssw0rd!' \
ParameterKey=BastionAllowedCIDR,ParameterValue=203.0.113.25/32 \
--capabilities CAPABILITY_NAMED_IAMDeployment takes ~15-20 minutes. See the Deployment Guide for post-deployment steps.
|
|
| Document | Description |
|---|---|
| SOC 2 Control Matrix | Maps each TSC to specific template resources — start here for audits |
| Architecture Overview | Network diagrams, traffic flows, encryption summary |
| Evidence Collection Guide | AWS CLI commands to collect every piece of audit evidence |
| Access Management Procedure | Granting, reviewing, and revoking access |
| Change Management Procedure | How infrastructure changes are proposed, reviewed, and deployed |
| Incident Response Procedure | Detection, triage, investigation, and remediation |
| Backup and Recovery Procedure | Backup inventory, recovery steps, RTO/RPO targets |
| Monitoring and Alerting Procedure | What's monitored, alert response, log review schedules |
| Deployment Guide | Step-by-step deployment and update instructions |
| Shared Responsibility Model | AWS vs. your responsibilities per service |
The Console groups parameters into numbered sections so you only need to focus on Section 1:
| Section | Parameters | Action Required |
|---|---|---|
| 1. Required | SSL certificate, key pair, DB password, SSH IP range | Fill these in |
| 2. Application Settings | DB name, username, instance sizes | Defaults are fine |
| 3. Database Sizing | Serverless capacity, instance class | Defaults auto-scale |
| 4. Compliance & Logging | Log retention, CloudTrail bucket, SSH port | Defaults meet SOC 2 |
| 5. Network — Advanced | VPC CIDR, subnet CIDRs, AMI | Almost never change |
┌────────────────────────────────────────────────────────────┐
│ VPC (10.0.0.0/16) │
│ │
│ ┌──────────────────────┐ ┌──────────────────────┐ │
│ │ Public Subnet AZ-A │ │ Public Subnet AZ-B │ │
│ │ ALB, NAT GW, Bastion│ │ ALB, NAT GW │ │
│ └──────────┬───────────┘ └──────────┬───────────┘ │
│ │ │ │
│ ┌──────────▼───────────┐ ┌──────────▼───────────┐ │
│ │ Private Subnet AZ-A │ │ Private Subnet AZ-B │ │
│ │ Web App, Aurora, │ │ Web App, Aurora, │ │
│ │ EFS Mount Target │ │ EFS Mount Target │ │
│ └──────────────────────┘ └──────────────────────┘ │
└────────────────────────────────────────────────────────────┘
We welcome contributions! See CONTRIBUTING.md for guidelines.
Copyright 2022-2026 Merchant Protocol. Released under the MIT License.