Compliance Frameworks Across Clouds

# AWS: Enable compliance monitoring with Security Hub
aws securityhub enable-security-hub \
  --enable-default-standards

# Enable SOC 2 standard
aws securityhub batch-enable-standards \
  --standards-subscription-requests '[
    {"StandardsArn": "arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0"}
  ]'

# Azure: Enable Defender for Cloud with regulatory compliance
az security pricing create --name VirtualMachines --tier Standard
az security auto-provisioning-setting update --name default --auto-provision On

# GCP: Enable Security Command Center
gcloud scc organizations update-settings \
  --organization=ORG_ID \
  --enable-modules=SECURITY_HEALTH_ANALYTICS,WEB_SECURITY_SCANNER

# AWS HIPAA: Use only eligible services and enforce encryption
# Create an SCP to restrict to HIPAA-eligible services
cat > hipaa-scp.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "NotAction": [
        "ec2:*", "s3:*", "rds:*", "lambda:*", "dynamodb:*",
        "kms:*", "cloudtrail:*", "config:*", "cloudwatch:*",
        "iam:*", "sts:*", "elasticloadbalancing:*",
        "sqs:*", "sns:*", "secretsmanager:*"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": ["us-east-1", "us-west-2"]
        }
      }
    }
  ]
}
EOF

# Enforce S3 encryption for PHI
aws s3api put-bucket-encryption \
  --bucket phi-data-bucket \
  --server-side-encryption-configuration '{
    "Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "aws:kms", "KMSMasterKeyID": "alias/phi-key"}, "BucketKeyEnabled": true}]
  }'

# Block public access on PHI buckets
aws s3api put-public-access-block \
  --bucket phi-data-bucket \
  --public-access-block-configuration '{
    "BlockPublicAcls": true, "IgnorePublicAcls": true,
    "BlockPublicPolicy": true, "RestrictPublicBuckets": true
  }'

# AWS Config Rules for continuous compliance
resource "aws_config_config_rule" "encrypted_volumes" {
  name = "encrypted-volumes"
  source {
    owner             = "AWS"
    source_identifier = "ENCRYPTED_VOLUMES"
  }
}

resource "aws_config_config_rule" "root_mfa" {
  name = "root-account-mfa-enabled"
  source {
    owner             = "AWS"
    source_identifier = "ROOT_ACCOUNT_MFA_ENABLED"
  }
}

resource "aws_config_config_rule" "s3_encryption" {
  name = "s3-bucket-server-side-encryption-enabled"
  source {
    owner             = "AWS"
    source_identifier = "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED"
  }
}

# Azure Policy for compliance
resource "azurerm_policy_assignment" "hipaa" {
  name                 = "hipaa-hitrust"
  scope                = azurerm_management_group.main.id
  policy_definition_id = "/providers/Microsoft.Authorization/policySetDefinitions/a169a624-5599-4385-a696-c8d643089fab"
  display_name         = "HIPAA HITRUST 9.2"
}

# GCP Organization Policy for compliance
resource "google_organization_policy" "restrict_regions" {
  org_id     = var.org_id
  constraint = "constraints/gcp.resourceLocations"

  list_policy {
    allow {
      values = ["in:us-locations"]
    }
  }
}