The big TL;DR: SOC-2 is an "report" not a "certification". They don't tell you what you must do, they examine what you say you do, and then compare records to your policies to attest that you're a company who follows your own rules.

Design your controls the way that makes sense for your business, keep records, and then during the audit, make a case for why you are living up to your own standards. SOC-2 will ask questions that will make you think "oh we should do that" but it is perfectly acceptable to say that you don't do it, if it doesn't matter to your business or if you have other "controls" that meet the same standard.

Example:

• SOC-2: Do you force rotate passwords every 90 days?
• Us: No, based on NIST and Microsoft Research recommendations that say forced password rotations encourage users to choose simple variants on easy to remember passwords, we instead require 2 factor authentication and complex passwords which may be set indefinitely.

Doing some risk analysis can be a huge benefit, to help you

This guide describes how to grant IAM permissions in an Amazon account, but only through CloudFormation.

1. First, create a role called cloudformation which has permission to do everything an engineer might need to do.

2. Give that role a trust policy which will allow only AWS CloudFormation to actually use it:

{
  "Version": "2012-10-17",
  "Statement": [

IRC and Slack channels can be a great resource for debugging confusing problems, and people are often very willing to jump in and work through it with you, however there are some things you should provide upfront when asking a question. Filling out this template will help you get an answer faster, and will make it easier for someone to jump in and help.

Describe what you expect to happen when the problem is solved.

Describe the specific problem you're seeing. Start with the thing that made you notice there was a problem and follow your investigation forward from there.