SOC 2 · AWS
Fix failing SOC 2 access and logging tests in AWS
Deixic removes IAM users and administrator roles nobody has used in 180 days, turns on CloudTrail, and waits for an approver before touching production admin access.
Tests Deixic fixes in AWS
Criteria touched: CC6.1 Logical access, including MFA, CC6.3 Access modification and least privilege, CC7.2 Monitoring and logging.
Failing testWhat Deixic doesCriterion
No unused administrator rolesDeletes an administrator role that no one has assumed in 180 days and no active service trusts.CC6.3
No stale IAM users or keysDeactivates access keys and removes IAM users unused for 180 days.CC6.1
Audit logging enabledTurns on a multi-region CloudTrail trail with log file validation.CC7.2
What runs, what waits, what is yours
Deixic classifies every AWS action before it runs.
Runs within policy
- Deactivate an access key unused for 180 days
- Delete an administrator role unused for 180 days
- Enable CloudTrail
Waits for a named approver
- Removing production admin access from a person
- Changing a policy attached to a role in use
Sent to you as a decision
- Deleting a user or role used in the last 180 days.
- Closing an account or changing the root user.
Read back and evidence
Each change is read back from AWS, attached to the test in your compliance platform (or kept in Deixic if you have none), and the test runs again.
Deixic reads back
- The key status and role list after each removal
- The CloudTrail trail status and log validation flag
Your auditor gets
- The last-used date that cleared each removal
- Before and after IAM state
- The CloudTrail configuration the test read