Integration · Cloud & infrastructure

AWS integration for continuous SOC 2, ISO 27001 & PCI DSS compliance

CATAAM connects to AWS with read-only access and runs 40 automated checks against your real configuration. The results map to 36 controls across 12 frameworks, including SOC 2, ISO 27001, PCI DSS, GDPR, NIST CSF, SOC 1.

automated checks: 40
controls mapped: 36
frameworks: 12

What happens when you connect AWS

Connect with read-only access
Add a read-only role, OAuth scope or API token for AWS. The credential is encrypted at rest.
Discover assets
CATAAM pulls the accounts, users, repositories or devices it finds into one asset inventory.
Run 40 automated checks
Every check runs against your real configuration, then keeps running on a schedule.
Map results to 36 controls
Each result lands on the controls it proves — and counts for every framework that shares them.
Store evidence and raise issues
Passing checks become audit evidence. Failures show up for the control owner and can open a Jira issue.

Create the read-only IAM role

AWS connects through a cross-account IAM role in your own account, so CATAAM never stores access keys. Deploy either template, then paste the role ARN into CATAAM.

CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: Read-only role for CATAAM
Resources:
  CataamReadRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: CATAAM-ReadRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::615299771288:root
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/ReadOnlyAccess
Outputs:
  RoleArn:
    Value: !GetAtt CataamReadRole.Arn

Terraform

resource "aws_iam_role" "cataam" {
  name = "CATAAM-ReadRole"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Action    = "sts:AssumeRole"
      Principal = { AWS = "arn:aws:iam::615299771288:root" }
    }]
  })
}

resource "aws_iam_role_policy_attachment" "cataam_read" {
  role       = aws_iam_role.cataam.name
  policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
}

output "cataam_role_arn" {
  value = aws_iam_role.cataam.arn
}

The role name must start with CATAAM- (case-sensitive). The managed ReadOnlyAccess policy is enough; SecurityAudit is optional.

The 40 checks CATAAM runs on AWS

Each check runs against your real AWS configuration and keeps running on a schedule. Check names are shown as they appear in the CATAAM platform.

AWS accounts deprovisioned when personnel leave
AWS accounts reviewed
Clocks on infrastructure system synchronized
CloudTrail enabled
Critical vulnerabilities identified in packages are addressed (AWS Container)
EBS volumes attached to EC2 instances are encrypted (AWS)
EC2 instances are Systems Manager managed and patch compliant (AWS)
EC2 instances do not expose management ports (SSH/RDP) to the internet (AWS)
EC2 instances require IMDSv2 (AWS)
EC2 instances run with an instance profile, not static keys (AWS)
Enabled IAM User Access Keys must not be older than 90 days
Firewall default disallows traffic
Groups manage employee accounts permissions
High vulnerabilities identified in packages are addressed (AWS Container)
Intrusion detection system enabled (AWS)
Intrusion detection system notifications configured (AWS)
Inventory items have active owners
Inventory items have descriptions
Inventory list tracks resources that contain user data
Load balancer used (AWS)
Low vulnerabilities identified in packages are addressed (AWS Container)
MFA on infrastructure provider
MFA on infrastructure root accounts (AWS)
Medium vulnerabilities identified in packages are addressed (AWS Container)
Network segregation
No user account has a policy attached directly
Old infrastructure accounts disabled (AWS)
Password policy configured for infrastructure
Root infrastructure account unused
S3 Block Public Access feature enabled (AWS)
S3 server access logs enabled
SSL configuration has no known issues
SSL/TLS certificate has not expired
SSL/TLS enforced on company website
SSL/TLS on admin page of infrastructure console
Server logs retained for 365 days (AWS)
Service accounts used
VPC Flow Logs enabled
Vulnerability scan
Vulnerability scanning is enabled (AWS)

Controls these checks support (36)

A passing check becomes evidence for each control below, and counts for every framework that shares the control.

Control	Requirement	Frameworks
AST-3	Production inventory maintained	SOC 2, ISO 27001, NIST CSF, COBIT 5, ITIL
CHG-1	Change management procedures enforced	SOC 2, ISO 27001, PCI DSS, NIST CSF, SOC 1 +2
CHG-2	Production deployment access restricted	SOC 2, ISO 27001, SOC 1, ITIL
CRY-1	Unique production database authentication enforced	SOC 2, ISO 27001
CRY-2	Encryption key access restricted	SOC 2, ISO 27001, SOC 1
CRY-4	Data encryption utilized	SOC 2, PCI DSS, NIST CSF, SOC 1, Australian Privacy Principles +1
CRY-5	Unique account authentication enforced	SOC 2
IAC-1	Production application access restricted	SOC 2, ISO 27001, SOC 1
IAC-3	Production database access restricted	SOC 2, ISO 27001, SOC 1
IAC-4	Firewall access restricted	SOC 2, SOC 1
IAC-5	Production OS access restricted	SOC 2, ISO 27001, SOC 1
IAC-6	Production network access restricted	SOC 2, ISO 27001, SOC 1
IAC-7	Access reviews conducted	SOC 2, ISO 27001, PCI DSS, NIST CSF, SOC 1 +2
IAC-8	Access revoked upon termination	SOC 2, ISO 27001, SOC 1
IAC-12	Remote access MFA enforced	SOC 2, ISO 27001, PCI DSS, NIST CSF, SOC 1 +1
MON-1	Intrusion detection system utilized	SOC 2, PCI DSS, NIST CSF, COBIT 5
MON-2	Log management utilized	SOC 2, PCI DSS, NIST CSF, COBIT 5, ITIL
MON-4	Infrastructure performance monitored	SOC 2, ISO 27001, PCI DSS, NIST CSF, COBIT 5 +1
NET-2	Network segmentation implemented	SOC 2, ISO 27001, PCI DSS, NIST CSF
NET-3	Network firewalls reviewed	SOC 2, ISO 27001, PCI DSS
NET-4	Network firewalls utilized	SOC 2, ISO 27001, PCI DSS, NIST CSF, COBIT 5
NET-5	Network and system hardening standards maintained	SOC 2, ISO 27001, PCI DSS, NIST CSF, COBIT 5
VPM-1	Service infrastructure maintained	SOC 2, COBIT 5, ITIL
VPM-2	Vulnerabilities scanned and remediated	SOC 2, ISO 27001, PCI DSS, NIST CSF, Essential Eight +3
AST-45	Production inventory maintained	GDPR
CRY-56	Data encryption utilized	GDPR, DPDP Act
IAC-85	Remote access MFA enforced	GDPR, DPDP Act
IAC-86	Production network access restricted	GDPR
IAC-87	Production deployment access restricted	GDPR
IAC-89	Unique account authentication enforced	GDPR
NET-37	Network firewalls utilized	GDPR, DPDP Act
NET-38	Network segmentation implemented	GDPR
NET-39	Network firewalls reviewed	GDPR
SEA-23	Network and system hardening standards maintained	GDPR, DPDP Act
THR-2	Intrusion detection system utilized	GDPR
VPM-38	Service infrastructure maintained	GDPR

AWS integration: frequently asked questions

What does CATAAM check in AWS?

CATAAM runs 40 automated checks on AWS, for example: AWS accounts deprovisioned when personnel leave; AWS accounts reviewed; Clocks on infrastructure system synchronized; CloudTrail enabled. The full list is on this page.

Which compliance frameworks does the AWS integration support?

The AWS checks map to 36 controls and count toward SOC 2, ISO 27001, PCI DSS, GDPR, NIST CSF, SOC 1.

Does CATAAM need write access to AWS?

No. Connectors use read-only roles, scopes or API tokens, and credentials are encrypted at rest. The only optional write anywhere in CATAAM is opening Jira issues for failed checks.

How do I connect AWS to CATAAM?

Add a read-only role, OAuth scope or API token for AWS in CATAAM. CATAAM then discovers your assets, runs the checks and keeps running them on a schedule, storing each result as audit evidence.