/gap-to-code

description: Convert SOC 2 gap analysis findings to Infrastructure as Code fixes

SOC 2 Gap-to-Code Generator

Analyzes SOC 2 gap assessment results and generates production-ready Infrastructure as Code (Terraform, CloudFormation, Kubernetes) to remediate identified gaps automatically.

Usage

/soc2:gap-to-code <gap-file> <cloud-provider> [options]

Arguments

• `$1` - Gap analysis file (JSON output from `/soc2:assess`)
• `$2` - Cloud provider: "aws", "azure", "gcp", "kubernetes", or "multi-cloud"
• `$3` - Options (optional): `--output-dir=path`, `--format=terraform|cloudformation`, `--apply`

Examples

# Generate Terraform for AWS gaps
/soc2:assess security type2 --output=json > gaps.json
/soc2:gap-to-code gaps.json aws --output-dir=./remediation

# Generate CloudFormation
/soc2:gap-to-code gaps.json aws --format=cloudformation

# Multi-cloud remediation
/soc2:gap-to-code gaps.json multi-cloud --output-dir=./iac

# Dry-run mode (default)
/soc2:gap-to-code gaps.json aws

# Actually apply fixes (DANGEROUS - review first!)
/soc2:gap-to-code gaps.json aws --apply

Output

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SOC 2 GAP-TO-CODE REMEDIATION GENERATOR
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Input: gaps.json
Cloud Provider: AWS
Output Format: Terraform
Output Directory: ./remediation
Mode: DRY RUN (review before applying)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
GAP ANALYSIS SUMMARY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Total Gaps: 12
  🔴 High Severity: 3 (remediable via IaC)
  🟡 Medium Severity: 5 (remediable via IaC)
  🔵 Low Severity: 2 (remediable via IaC)
  ⚠ Manual: 2 (require policy/process changes)

Automated Remediation: 10/12 gaps (83%)
Estimated Time to Fix: 2.5 hours (manual review + terraform apply)
Estimated Cost Impact: +$45/month (additional AWS resources)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
GENERATED INFRASTRUCTURE AS CODE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Files Created:
✓ ./remediation/main.tf (450 lines)
✓ ./remediation/variables.tf (85 lines)
✓ ./remediation/outputs.tf (42 lines)
✓ ./remediation/versions.tf (12 lines)
✓ ./remediation/README.md (comprehensive deployment guide)
✓ ./remediation/test_plan.md (validation steps)

Modules Created:
✓ ./remediation/modules/encryption/
✓ ./remediation/modules/logging/
✓ ./remediation/modules/access_control/
✓ ./remediation/modules/monitoring/

Scripts Created:
✓ ./remediation/scripts/validate_remediation.sh
✓ ./remediation/scripts/collect_evidence.sh
✓ ./remediation/scripts/rollback.sh

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
REMEDIATIONS BY CONTROL
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

[1] CC6.7 - Encryption at Rest (HIGH PRIORITY)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Gap Description:
  3 S3 buckets lack encryption at rest
  Buckets: legacy-backups-2019, temp-storage-dev, logs-archive-old
  Risk: Data exposure if bucket accessed without authorization
  SOC 2 Requirement: CC6.7 (encryption protects data)

Remediation Type: AUTOMATED
Effort: 5 minutes (terraform apply)
Cost Impact: $0/month (S3 encryption is free)

Generated Code: ./remediation/modules/encryption/s3_encryption.tf
```terraform
# Remediation for CC6.7 - S3 Encryption at Rest
# Satisfies: SOC 2 CC6.7, PCI-DSS 3.4, NIST SC-28

resource "aws_s3_bucket_server_side_encryption_configuration" "legacy_backups" {
  bucket = "legacy-backups-2019"

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "AES256"
      # Alternative: Use KMS for customer-managed keys
      # sse_algorithm     = "aws:kms"
      # kms_master_key_id = aws_kms_key.s3_encryption.arn
    }
    bucket_key_enabled = true  # Reduces KMS costs
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "temp_storage" {
  bucket = "temp-storage-dev"

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
    bucket_key_enabled = true
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "logs_archive" {
  bucket = "logs-archive-old"

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
    bucket_key_enabled = true
  }
}

# Optional: Enforce encryption via bucket policy
resource "aws_s3_bucket_policy" "enforce_encryption" {
  for_each = toset([
    "legacy-backups-2019",
    "temp-storage-dev",
    "logs-archive-old"
  ])

  bucket = each.value

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "DenyUnencryptedObjectUploads"
        Effect    = "Deny"
        Principal = "*"
        Action    = "s3:PutObject"
        Resource  = "arn:aws:s3:::${each.value}/*"
        Condition = {
          StringNotEquals = {
            "s3:x-amz-server-side-encryption" = "AES256"
          }
        }
      }
    ]
  })
}

Validation Steps:

# After applying, verify encryption
aws s3api get-bucket-encryption --bucket legacy-backups-2019
aws s3api get-bucket-encryption --bucket temp-storage-dev
aws s3api get-bucket-encryption --bucket logs-archive-old

# Expected output: "AES256" encryption enabled

Evidence Collection:

# Collect evidence for auditor
aws s3api get-bucket-encryption --bucket legacy-backups-2019 > evidence/cc6-7-encryption.json

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ [2] CC7.2 - Audit Log Retention (HIGH PRIORITY) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Gap Description: CloudTrail logs retained for 90 days (should be 365 days) Current retention: 90 days Required: 1 year (SOC 2, PCI-DSS) Risk: Cannot investigate incidents >90 days old

Remediation Type: AUTOMATED Effort: 2 minutes (terraform apply) Cost Impact: +$12/month (additional S3 storage + Glacier)

Generated Code: ./remediation/modules/logging/cloudtrail_retention.tf

# Remediation for CC7.2 - Audit Log Retention
# Satisfies: SOC 2 CC7.2/C