How do I handle SOC 2 evidence for Terraform or infrastructure-as-code?

Why IaC Is Great for SOC 2

Terraform and other IaC tools create a natural audit trail. Every infrastructure change is:

• Written as code (reviewable)
• Committed through a PR (approved)
• Applied through a pipeline (controlled)
• Stored in version history (traceable)

This is stronger evidence than manual console changes, which leave only CloudTrail logs.

Evidence to Provide

Evidence Type	What to Capture
Terraform code repository	GitHub repo showing .tf files with version history
PR reviews for infra changes	Sample PRs showing review and approval of .tf changes
Plan/apply pipeline	CI/CD workflow that runs terraform plan on PR and terraform apply on merge
State management	Backend configuration (S3 + DynamoDB lock, Terraform Cloud)
Access controls	Who can run terraform apply in production
Drift detection	How you detect manual changes outside Terraform

Mapping IaC to SOC 2 Controls

SOC 2 Control	IaC Evidence
CC8.1 (Change management)	PR-based workflow for all .tf changes
CC6.1 (Access controls)	IAM policies defined in code, reviewable
CC7.2 (Monitoring)	CloudWatch alarms defined in Terraform
CC6.7 (Data protection)	Encryption settings defined in code

Best Practices

1. Never apply directly. Use a CI/CD pipeline for terraform apply — this ensures every change is logged and traceable.
2. Require PR reviews. Treat Terraform PRs like application code PRs — same branch protection, same review requirements.
3. Lock state. Use a remote backend with state locking to prevent concurrent modifications.
4. Detect drift. Run periodic terraform plan to find manual changes made outside IaC. Document and remediate drift.

Handling Manual Changes

If someone makes a console change outside Terraform, document it as an exception:

• What was changed and why
• Was it imported back into Terraform state?
• Was a follow-up PR created to codify the change?

Auditors understand that occasional manual changes happen. What matters is that you detect them and bring them back into your controlled process.