import { Request, Response, NextFunction } from 'express';

interface AuditLogEntry {
  timestamp: string;
  userId: string;
  action: string;
  resource: string;
  ipAddress: string;
  correlationId: string;
  status: string;
}

// Mask sensitive fields to comply with Confidentiality criteria
const maskPII = (obj: any): any => {
  const sensitiveKeys = ['password', 'ssn', 'creditCard', 'token'];
  const masked = { ...obj };
  sensitiveKeys.forEach(key => {
    if (masked[key]) masked[key] = '***MASKED***';
  });
  return masked;
};

export const auditLogger = (req: Request, res: Response, next: NextFunction) => {
  const correlationId = req.headers['x-correlation-id'] as string || crypto.randomUUID();
  req.headers['x-correlation-id'] = correlationId;

  const logEntry: AuditLogEntry = {
    timestamp: new Date().toISOString(),
    userId: (req as any).user?.id || 'anonymous',
    action: req.method,
    resource: req.path,
    ipAddress: req.ip,
    correlationId,
    status: 'initiated'
  };

  // Send to secure, immutable logging sink (e.g., CloudWatch, Datadog)
  console.log(JSON.stringify(logEntry));

  // Capture response status
  const originalSend = res.send;
  res.send = function (body: any) {
    logEntry.status = res.statusCode.toString();
    console.log(JSON.stringify({ ...logEntry, timestamp: new Date().toISOString() }));
    ret

urn originalSend.call(this, body); };

next(); };

#### TypeScript: CI/CD Compliance Gate Simulation
This script simulates a pre-commit or pipeline check that validates IaC configurations against SOC2 controls.

```typescript
import { execSync } from 'child_process';

interface ComplianceCheck {
  name: string;
  command: string;
  description: string;
}

const checks: ComplianceCheck[] = [
  {
    name: 'IaC Security Scan',
    command: 'checkov -d ./infrastructure --framework terraform --quiet',
    description: 'Ensures no S3 buckets are public and encryption is enabled.'
  },
  {
    name: 'Dependency Vulnerability Check',
    command: 'npm audit --audit-level=high',
    description: 'Verifies no high-severity vulnerabilities in dependencies.'
  },
  {
    name: 'Secret Detection',
    command: 'gitleaks detect --source . --verbose',
    description: 'Prevents hardcoded secrets from entering the repository.'
  }
];

async function runComplianceGate(): Promise<void> {
  console.log('Running SOC2 Compliance Gates...');
  let failed = false;

  for (const check of checks) {
    console.log(`Executing: ${check.name}`);
    try {
      execSync(check.command, { stdio: 'inherit' });
      console.log(`✅ ${check.name} passed.`);
    } catch (error) {
      console.error(`❌ ${check.name} failed. ${check.description}`);
      failed = true;
    }
  }

  if (failed) {
    console.error('Compliance gate failed. Deployment blocked.');
    process.exit(1);
  }
  
  console.log('All compliance gates passed.');
}

runComplianceGate();

Architecture Decisions and Rationale

Decision: Use a hybrid model of native cloud controls and third-party compliance automation platforms. Rationale: Native controls (AWS Config, Azure Policy) provide the lowest latency and highest fidelity for infrastructure checks. However, they lack cross-cloud normalization and automated evidence packaging. A compliance platform aggregates native signals, normalizes them against TSC, and generates audit-ready reports. This reduces engineering overhead for evidence management while maintaining technical accuracy.

Decision: Implement immutable logging with write-once-read-many (WORM) storage. Rationale: SOC2 requires evidence integrity. If logs can be modified, auditors cannot trust them. Using WORM storage or append-only databases ensures that evidence cannot be tampered with post-creation, satisfying the Integrity criterion and reducing audit scrutiny on evidence validity.

Decision: Enforce MFA and SSO via Identity Provider (IdP) with SCIM provisioning. Rationale: Manual user management is a control failure risk. SCIM automation ensures that access is granted and revoked instantly based on HR events. This satisfies Access Control criteria and eliminates orphaned accounts, a common audit finding.

Pitfall Guide

1. Over-Scoping the System Boundary: Including non-critical systems in the audit scope increases cost and complexity without adding value. Best Practice: Rigorously define the boundary based on data flow and customer impact. Exclude development environments that do not touch production data.

2. Weak Access Reviews: Conducting access reviews only during the audit window is insufficient. Best Practice: Automate quarterly access recertification. Use scripts to generate access reports and require manager approval via ticketing systems. Document the review process and outcomes.

3. Ignoring Third-Party Risk: SOC2 extends to vendors that process customer data. Best Practice: Maintain a vendor inventory. Require SOC2 reports from critical vendors. Implement contractual security clauses. Automate vendor risk assessments where possible.

4. Logging Gaps for PII/Sensitive Data: Logging sensitive data violates Confidentiality and Privacy criteria. Best Practice: Implement automated PII detection in logging pipelines. Mask or hash sensitive fields before they reach the log store. Regularly audit log content for leakage.

5. CI/CD Without Compliance Gates: Allowing code to deploy without automated security checks relies on human vigilance, which is unreliable. Best Practice: Integrate SAST, SCA, and IaC scanning into the pipeline. Block merges on critical findings. Treat compliance errors as build failures.

6. Snapshot Mentality: Treating SOC2 as a point-in-time certification rather than a continuous process. Best Practice: Adopt continuous monitoring. Configure alerts for control drift. Remediate findings immediately, not just before the audit.

7. Incident Response Without Drills: Having an IR policy is required, but auditors test its effectiveness. Best Practice: Conduct bi-annual tabletop exercises. Simulate breaches and document the response. Update the IR plan based on lessons learned. Ensure communication channels are tested.

Production Bundle

Action Checklist

• Define System Boundary: Document all systems, data flows, and personnel within the SOC2 scope.
• Enforce MFA: Enable Multi-Factor Authentication for all cloud providers, IdPs, and critical SaaS tools.
• Implement Least Privilege IAM: Review and restrict permissions; remove wildcard access; enforce role-based access control.
• Enable Cloud Logging: Activate CloudTrail, Azure Activity Logs, or GCP Audit Logs; forward to centralized, immutable storage.
• Encrypt Data: Ensure encryption at rest (KMS-managed keys) and in transit (TLS 1.2+) for all production data stores.
• Automate Evidence Collection: Deploy compliance agents or configure API integrations to gather evidence continuously.
• Conduct Access Review: Perform a full access recertification for all users and service accounts within the scope.
• Run Penetration Test: Engage an accredited third party to perform a penetration test and remediate all findings.

Decision Matrix

Scenario	Recommended Approach	Why	Cost Impact
Early-stage startup (<10 engineers)	Native cloud controls + Lightweight vCISO tool	Low overhead, fast setup, sufficient for initial enterprise sales.	Low ($5k-$10k/yr)
Scaling SaaS (10-100 engineers)	Compliance-as-Code + Automated Evidence Platform	Scalability, reduced engineering drag, continuous audit readiness.	Medium ($20k-$50k/yr)
Enterprise / Regulated Industry	Full automation + Dedicated Compliance Engineer + Custom IaC policies	Highest assurance, meets strict customer requirements, minimizes risk.	High ($100k+/yr)
Multi-cloud environment	Centralized policy engine (e.g., OPA) + Aggregation tool	Unified policy definition across AWS/GCP/Azure, simplifies management.	Medium-High
Manual evidence only	Not recommended	High risk of failure, sales cycle delays, engineering burnout.	Hidden High (Opportunity cost)

Configuration Template

Terraform: SOC2-Compliant S3 Bucket Configuration This template enforces encryption, logging, and access controls required by SOC2.

resource "aws_s3_bucket" "secure_data" {
  bucket = "my-secure-data-bucket-${var.environment}"

  tags = {
    Environment = var.environment
    Compliance  = "SOC2"
  }
}

# Enforce SSL/TLS for all requests
resource "aws_s3_bucket_policy" "enforce_ssl" {
  bucket = aws_s3_bucket.secure_data.id
  policy = data.aws_iam_policy_document.enforce_ssl.json
}

data "aws_iam_policy_document" "enforce_ssl" {
  statement {
    sid    = "EnforceTLS"
    effect = "Deny"
    principals {
      type        = "*"
      identifiers = ["*"]
    }
    actions = [
      "s3:*",
    ]
    resources = [
      aws_s3_bucket.secure_data.arn,
      "${aws_s3_bucket.secure_data.arn}/*",
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }
}

# Enable server-side encryption with KMS
resource "aws_s3_bucket_server_side_encryption_configuration" "secure_data" {
  bucket = aws_s3_bucket.secure_data.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.s3_key.arn
    }
  }
}

# Enable versioning for data integrity and recovery
resource "aws_s3_bucket_versioning" "secure_data" {
  bucket = aws_s3_bucket.secure_data.id
  versioning_configuration {
    status = "Enabled"
  }
}

# Block all public access
resource "aws_s3_bucket_public_access_block" "secure_data" {
  bucket = aws_s3_bucket.secure_data.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# Enable access logging
resource "aws_s3_bucket_logging" "secure_data" {
  bucket = aws_s3_bucket.secure_data.id

  target_bucket = aws_s3_bucket.log_bucket.id
  target_prefix = "log/${aws_s3_bucket.secure_data.id}/"
}

Quick Start Guide

1. Initialize Compliance Tooling: Install a compliance automation agent (e.g., Vanta, Drata, or custom scripts) in your cloud account. Grant read-only access for evidence collection.
2. Connect Identity Provider: Integrate your IdP (Okta, Azure AD) to automate user provisioning and access reviews. Enable SCIM synchronization.
3. Run Baseline Scan: Execute a full scan of your infrastructure. Review findings and prioritize remediation of critical control gaps (e.g., public storage, missing MFA).
4. Configure CI/CD Gates: Add compliance checks to your pipeline. Ensure builds fail on security violations or policy breaches.
5. Schedule Continuous Monitoring: Set up automated alerts for control drift. Verify that evidence is being collected daily and stored securely. Prepare for the audit by reviewing the automated evidence dashboard.