SOC 2 ready AWS architecture for startups is decided before the first auditor kickoff. Account layout, human identity, logging, and change control either make CC6/CC7 evidence cheap or they make the first Type II a retrofit. A single shared AWS account with IAM users, no org trail, and production access from laptops is a working MVP. It is a painful observation period.
Rutagon builds the AWS shape that a 50–500 person company can take into a SOC 2 program. We do not hold a SOC 2 attestation. We do not hold FedRAMP authorization. We do hold the Terraform and the pipelines. "Ready" means the architecture will not fight the criteria — not that a report already exists.
The Decisions That Lock You In
Accounts. One account for everything means every engineer is a blast radius. A small org — management, prod, nonprod, and a log/security account — is enough for most startups. AWS Organizations and a central CloudTrail are table stakes (AWS Organizations).
Humans. IAM Identity Center permission sets, not IAM users with keys. Production permission sets are break-glass or just-in-time, not standing admin on every engineer.
Workloads. Roles. OIDC for CI. No long-lived keys in GitHub. See workload identity federation migration.
Logs. Org CloudTrail to a locked bucket in the log account, plus the application logs you already need for product. Retention covers the observation period. Access to the log account is its own review.
Change. Infrastructure is Terraform. Console clicks in prod are exceptions, not the culture.
NIST SP 800-53 Rev. 5 AC-2, AU-2, and CM-3 are the federal phrasing of the same four ideas (NIST SP 800-53 Rev. 5). You can be commercial-only and still steal the structure.
SOC 2 Ready AWS Architecture for Startups We Actually Lay Down
# Sketch — org + trail, not a full landing zone product
resource "aws_organizations_organization" "this" {
feature_set = "ALL"
enabled_policy_types = ["SERVICE_CONTROL_POLICY"]
}
resource "aws_cloudtrail" "org" {
name = "org-trail"
is_organization_trail = true
is_multi_region_trail = true
s3_bucket_name = aws_s3_bucket.logs.id
kms_key_id = aws_kms_key.logs.arn
}
SCPs deny leaving the org, deny disabling the trail, and deny creating IAM user access keys except in a break-glass account. That is preventive control language a GRC tool can point at. Detective siblings — Config, GuardDuty, Security Hub — belong in the security account, not as five copies of each product in every account.
This is the bridge to AWS Control Tower guardrails for compliance if you want a managed landing zone, and to AWS IAM Identity Center SOC 2 architecture. Capability: AWS cloud infrastructure.
What We Leave Out on Purpose
We do not drop a 30-account Control Tower on a 12-person team. We do not enable every Config rule in the CIS pack on day one and drown the on-call. We do not claim the landing zone is a FedRAMP package. We do not migrate you off a GRC tool. The GRC tool attaches to this architecture; it does not replace it.
Encryption at rest, TLS, backups, and WAF are on the checklist. They are not the first conversation if humans still share an access key. Fix identity and the trail first; then the checklist is cheap.
Timing Relative to the Audit Clock
If the observation window has not started, we land accounts, Identity Center, org trail, and CI OIDC first. If the window is already running, we do not "fix" history by deleting accounts. We add the missing logs going forward and write the gap honestly. Auditors prefer a dated gap to a rewritten past. A CFO who wants "ready by next month" needs to hear that identity and logging are the path, not a new GRC logo.
A content platform and a production SaaS platform we operate internally already follow this shape: multi-account, Terraform, OIDC, no standing keys. That is the reference, named generically. Startups that copy only the service list and skip the log account repeat the retrofit. The unglamorous account is the one that makes the year of evidence possible.
Network defaults belong in the same first increment. Public RDS is a finding waiting for a sample. We put data stores in private subnets, use VPC endpoints for S3 and STS, and treat a bastion or SSM Session Manager as the human path — not a wide SSH security group. Session Manager logs to the same log account. That is architecture you can point at in a CC6 narrative without inventing a new product.
Secrets hygiene is part of "ready" even when the buyer came for accounts. Parameter Store or Secrets Manager with IAM access, no plaintext in Lambda environment screenshots, no Slack pastes of database URLs. If a secret must exist, it has a rotation owner or a federation replacement on the backlog. "We will clean secrets after the audit" is how Type II windows fail in month four.
Finally, we write a one-page system description while the Terraform is still small: accounts, data stores, identity, logging, and in-scope apps. That page is what the auditor and the GRC tool will quote. Updating it after every account add is cheaper than reconstructing tribal knowledge at kickoff.
Tagging is the unglamorous half of readiness. Cost and inventory tags (env, system, owner) are how Config, Security Hub, and Cost Explorer stay explainable. We enforce a small tag policy at the org. We do not invent a 40-key taxonomy on week one. An untagged production bucket is harder to evidence than a slightly ugly naming convention.
Backups are part of the architecture conversation even when the buyer came for identity. Aurora and RDS snapshot retention, S3 versioning on the log bucket, and a restore test with a dated ticket — that is CC7-adjacent continuity, not a separate product. We schedule the restore test. We do not assume snapshots exist because the checkbox is on.
Discuss a SOC 2-aligned AWS architecture review →
907-841-8407 · contact@rutagon.com
Frequently Asked Questions
How many AWS accounts does a startup need to be SOC 2 ready?
Enough to separate production data, non-production experiment, and logs/security. Four is a common minimum. One is a retrofit.
Do we need Control Tower?
No. Control Tower is a delivery option. Organizations + Terraform + SCPs can be enough. Choose Tower when you want the managed guardrail catalog and you will actually operate it.
Can we stay single-region?
Yes. Multi-region trails still record the region you use. Multi-region compute is a product choice, not a SOC 2 tax.
Does this make Rutagon our auditor?
No. We build the AWS and the evidence hooks. Your CPA firm writes the report.
Is "SOC 2 ready" the same as certified?
No. Ready means the architecture will not fight the criteria. Certified is a report from an auditor. Rutagon holds neither a SOC 2 report nor FedRAMP authorization.