Compliance-as-Code: Generating Policies from Regulatory Requirements with Kiro

Compliance in software organizations lives in an uncomfortable gap between two worlds. On one side, legal and compliance teams work with regulatory documents written in dense, ambiguous prose. On the other, engineering teams need specific, enforceable rules they can encode in CI pipelines and infrastructure policies. The translation between these worlds has historically required expensive consultants, months of interpretation, and constant manual auditing that scales with headcount rather than automation.

Kiro bridges this gap by translating regulatory requirements into enforceable code policies. We used it to achieve SOC 2 Type II compliance three months faster than projected, with 60% fewer manual audit findings.

The Compliance Translation Problem

Our company was pursuing SOC 2 Type II certification while simultaneously preparing for GDPR compliance in European markets. The challenge was not understanding what the regulations required at a high level — it was translating those requirements into specific, testable controls that our engineering team could implement and our CI pipeline could enforce.

Consider this SOC 2 Trust Services Criteria requirement:

CC6.1: The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events.

What does this mean in practice for a team running services on AWS? It could mean dozens of specific controls: IAM policy restrictions, network segmentation, encryption requirements, access logging, secret rotation policies. The interpretation is where organizations spend months arguing.

We had a compliance consultant who produced a 200-page controls document. Engineering looked at it and estimated 6 months to implement. Three months in, an audit revealed we had missed controls because the document was ambiguous about whether certain requirements applied to development environments.

How Kiro Generates Compliance Policies

We fed Kiro the relevant SOC 2 criteria alongside our infrastructure context, and asked it to generate enforceable policies. The key insight is that Kiro does not just produce documentation — it produces OPA (Open Policy Agent) policies, AWS Config rules, and CI checks that actually enforce the controls.

Here is how we described our context and requirements:

## Compliance Context

Framework: SOC 2 Type II
Relevant criteria: CC6.1 (Logical Access), CC6.6 (System Boundaries), 
  CC7.2 (Monitoring), CC8.1 (Change Management)

Infrastructure: AWS (EKS, RDS, S3, Lambda)
IaC: Terraform
CI: GitHub Actions
Policy engine: OPA/Conftest

Requirement: Generate enforceable policies for each control that can 
run in CI and produce audit evidence automatically.

Kiro generated a comprehensive policy suite. Here is the OPA policy for encryption at rest (derived from CC6.1):

# Policy: All data stores must have encryption at rest enabled
# SOC 2 Criteria: CC6.1 - Logical Access Security
# Evidence: Terraform plan validation in CI

package compliance.encryption

import future.keywords.in
import future.keywords.if

deny[msg] if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    not resource.change.after.storage_encrypted
    msg := sprintf(
        "CC6.1 VIOLATION: RDS instance '%s' does not have encryption at rest enabled. All databases must use encrypted storage.",
        [resource.change.after.identifier]
    )
}

deny[msg] if {
    resource := input.resource_changes[_]
    resource.type == "aws_s3_bucket"
    not has_encryption_configuration(resource)
    msg := sprintf(
        "CC6.1 VIOLATION: S3 bucket '%s' does not have default encryption configured.",
        [resource.change.after.bucket]
    )
}

deny[msg] if {
    resource := input.resource_changes[_]
    resource.type == "aws_ebs_volume"
    not resource.change.after.encrypted
    msg := sprintf(
        "CC6.1 VIOLATION: EBS volume '%s' is not encrypted.",
        [resource.name]
    )
}

has_encryption_configuration(resource) if {
    resource.change.after.server_side_encryption_configuration[_]
}

And the corresponding CI integration:

# .github/workflows/compliance-check.yml
name: Compliance Policy Check

on:
  pull_request:
    paths:
      - 'terraform/**'

jobs:
  policy-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        
      - name: Terraform Plan
        run: terraform plan -out=tfplan && terraform show -json tfplan > plan.json
        working-directory: terraform/
        
      - name: Run Compliance Policies
        uses: open-policy-agent/conftest-action@v2
        with:
          files: terraform/plan.json
          policy: policies/compliance/
          
      - name: Generate Audit Evidence
        if: success()
        run: |
          echo "## Compliance Check Passed" >> $GITHUB_STEP_SUMMARY
          echo "- Timestamp: $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> $GITHUB_STEP_SUMMARY
          echo "- Policies evaluated: $(find policies/compliance -name '*.rego' | wc -l)" >> $GITHUB_STEP_SUMMARY
          echo "- PR: #${{ github.event.pull_request.number }}" >> $GITHUB_STEP_SUMMARY

Automated Evidence Collection

SOC 2 audits require evidence that controls are operating effectively over time. Kiro generated AWS Config rules that continuously monitor compliance and produce audit-ready evidence:

# AWS Config rule for secret rotation (CC6.1)
resource "aws_config_config_rule" "secrets_rotation" {
  name = "soc2-cc61-secrets-rotation"

  source {
    owner             = "AWS"
    source_identifier = "SECRETSMANAGER_ROTATION_ENABLED_CHECK"
  }

  input_parameters = jsonencode({
    maxDaysSinceRotation = 90
  })

  tags = {
    compliance_framework = "soc2"
    control_id           = "CC6.1"
    evidence_type        = "continuous-monitoring"
  }
}

# AWS Config rule for encryption in transit (CC6.1)
resource "aws_config_config_rule" "alb_https_only" {
  name = "soc2-cc61-https-enforcement"

  source {
    owner             = "AWS"
    source_identifier = "ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK"
  }

  tags = {
    compliance_framework = "soc2"
    control_id           = "CC6.1"
    evidence_type        = "continuous-monitoring"
  }
}

Each rule is tagged with the specific SOC 2 control it enforces, making it trivial to produce audit evidence reports by querying AWS Config for compliance status grouped by control ID.

Before and After: Compliance Program Metrics

Metric	Before Kiro	After Kiro	Improvement
Time to translate controls to policies	4-6 months	3-4 weeks	85% reduction
Manual audit findings	23 per audit	9 per audit	61% reduction
Policy coverage (controls with automated checks)	35%	87%	149% increase
Time spent on evidence collection per audit	3 weeks	2 days	90% reduction
Compliance drift detection time	Next audit (6 months)	Real-time	Continuous

The shift from periodic audit-based compliance to continuous automated compliance is the real transformation. We no longer "prepare for audits." Our systems are continuously monitored, and compliance status is visible on a dashboard at all times.

Handling Regulatory Updates

When regulations change or new requirements emerge, Kiro helps us assess the gap quickly. We feed it the updated regulatory text, our current policy set, and ask it to identify what needs updating. For our GDPR data residency requirements, Kiro generated additional S3 bucket policies and VPC endpoint configurations within hours of us providing the updated requirements.

Conclusion

Compliance should not be a tax on engineering velocity. When regulatory requirements are encoded as automated policies, they become guardrails that prevent violations rather than audits that detect them after the fact. Kiro makes this encoding practical by bridging the language gap between regulatory prose and infrastructure code.

For CTOs navigating SOC 2, HIPAA, GDPR, or PCI DSS, the value proposition is clear: faster certification, fewer audit findings, continuous compliance visibility, and — critically — a compliance program that scales with your infrastructure rather than your headcount. The days of hiring additional compliance analysts for every new regulatory requirement should be behind us.