Building SOC2-Compliant Cloud Infrastructure - Security by Design in Multi-Tenant SaaS

# Custom MFA implementation for admin access
class MFARequiredMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response
        
    def __call__(self, request):
        if self.requires_mfa(request):
            if not self.verify_mfa_token(request):
                return HttpResponse(
                    'MFA required', 
                    status=401,
                    headers={'WWW-Authenticate': 'TOTP'}
                )
                
        response = self.get_response(request)
        
        # Log all administrative actions
        if self.is_admin_action(request):
            audit_logger.info(
                f"Admin action: {request.user.email} "
                f"performed {request.method} on {request.path}",
                extra={
                    'soc2_control': 'CC6.2',
                    'user_id': request.user.id,
                    'ip_address': self.get_client_ip(request),
                    'user_agent': request.META.get('HTTP_USER_AGENT')
                }
            )
            
        return response

# Structured logging for SOC2 compliance
import structlog
from pythonjsonlogger import jsonlogger

# Configure structured logging
structlog.configure(
    processors=[
        structlog.stdlib.filter_by_level,
        structlog.stdlib.add_logger_name,
        structlog.stdlib.add_log_level,
        structlog.stdlib.PositionalArgumentsFormatter(),
        structlog.processors.TimeStamper(fmt="iso"),
        structlog.processors.StackInfoRenderer(),
        structlog.processors.format_exc_info,
        structlog.processors.UnicodeDecoder(),
        structlog.processors.JSONRenderer()
    ],
    context_class=dict,
    logger_factory=structlog.stdlib.LoggerFactory(),
    cache_logger_on_first_use=True,
)

class SOC2AuditLogger:
    def __init__(self):
        self.logger = structlog.get_logger("soc2_audit")
        
    def log_data_access(self, user_id, resource_type, resource_id, action):
        self.logger.info(
            "data_access",
            soc2_control="CC6.3",
            user_id=user_id,
            resource_type=resource_type,
            resource_id=resource_id,
            action=action,
            timestamp=datetime.utcnow().isoformat()
        )
        
    def log_system_change(self, user_id, change_type, details):
        self.logger.info(
            "system_change",
            soc2_control="CC8.1",
            user_id=user_id,
            change_type=change_type,
            details=details,
            timestamp=datetime.utcnow().isoformat()
        )

# Security scanning pipeline
class ComplianceScanner:
    def __init__(self):
        self.findings = []
        
    def scan_infrastructure(self):
        # Check for security group violations
        open_security_groups = self.find_overly_permissive_security_groups()
        if open_security_groups:
            self.findings.append({
                'control': 'CC6.1',
                'severity': 'HIGH',
                'finding': 'Overly permissive security groups detected',
                'resources': open_security_groups
            })
            
        # Check for unencrypted resources
        unencrypted_resources = self.find_unencrypted_resources()
        if unencrypted_resources:
            self.findings.append({
                'control': 'CC6.7',
                'severity': 'CRITICAL',
                'finding': 'Unencrypted resources detected',
                'resources': unencrypted_resources
            })
            
    def generate_compliance_report(self):
        return {
            'scan_date': datetime.utcnow().isoformat(),
            'total_findings': len(self.findings),
            'critical_findings': len([f for f in self.findings if f['severity'] == 'CRITICAL']),
            'findings': self.findings
        }

class IncidentResponse:
    def __init__(self):
        self.slack_client = SlackClient(os.environ['SLACK_TOKEN'])
        self.pagerduty = PagerDutyClient(os.environ['PD_TOKEN'])
        
    def handle_security_incident(self, incident_type, severity, details):
        # Create incident ticket
        incident_id = self.create_jira_incident(
            incident_type=incident_type,
            severity=severity,
            details=details,
            soc2_control='CC7.1'
        )
        
        # Alert security team
        if severity in ['CRITICAL', 'HIGH']:
            self.pagerduty.trigger_incident(
                title=f"SOC2 Security Incident: {incident_type}",
                details=details,
                urgency='high'
            )
            
        # Automated containment actions
        if incident_type == 'data_breach':
            self.isolate_affected_systems()
            self.rotate_compromised_credentials()
            
        # Audit log the incident
        audit_logger.critical(
            "security_incident",
            incident_id=incident_id,
            incident_type=incident_type,
            severity=severity,
            soc2_control="CC7.1"
        )