We Used Vanta 2.0 to Get SOC 2 Certified in 2 Weeks and Saved $50k

import os
import sys
import json
import logging
from datetime import datetime, timedelta
from typing import List, Dict, Optional

import requests
from jira import JIRA, JIRAError
from dotenv import load_dotenv

# Configure logging for audit trail (required for SOC 2)
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s - %(levelname)s - %(message)s',
    handlers=[
        logging.FileHandler('vanta_jira_integration.log'),
        logging.StreamHandler(sys.stdout)
    ]
)
logger = logging.getLogger(__name__)

# Load environment variables from .env (never commit to GitHub!)
load_dotenv()

# Vanta API configuration
VANTA_API_BASE = 'https://api.vanta.com/v2'
VANTA_API_KEY = os.getenv('VANTA_API_KEY')
VANTA_ORG_ID = os.getenv('VANTA_ORG_ID')

# Jira configuration
JIRA_SERVER = os.getenv('JIRA_SERVER')
JIRA_USER = os.getenv('JIRA_USER')
JIRA_API_TOKEN = os.getenv('JIRA_API_TOKEN')
JIRA_PROJECT_KEY = os.getenv('JIRA_PROJECT_KEY', 'SOC2')
JIRA_REMEDIATION_ISSUE_TYPE = os.getenv('JIRA_ISSUE_TYPE', 'Task')

# Validate required environment variables
required_vars = [
    'VANTA_API_KEY', 'VANTA_ORG_ID', 'JIRA_SERVER',
    'JIRA_USER', 'JIRA_API_TOKEN'
]
missing_vars = [var for var in required_vars if not os.getenv(var)]
if missing_vars:
    logger.error(f'Missing required environment variables: {missing_vars}')
    sys.exit(1)

def get_vanta_failed_controls() -> List[Dict]:
    \\\"\\\"\"Fetch all failed controls from Vanta 2.0 API with pagination support.\\\"\\\"\"
    headers = {
        'Authorization': f'Bearer {VANTA_API_KEY}',
        'Content-Type': 'application/json'
    }
    failed_controls = []
    page = 1
    per_page = 100

    while True:
        try:
            response = requests.get(
                f'{VANTA_API_BASE}/organizations/{VANTA_ORG_ID}/controls',
                headers=headers,
                params={
                    'page': page,
                    'per_page': per_page,
                    'status': 'failed',
                    'framework': 'SOC2_TYPE_II'
                },
                timeout=10
            )
            response.raise_for_status()
            data = response.json()
            failed_controls.extend(data.get('controls', []))

            # Check if there are more pages
            if len(data.get('controls', [])) < per_page:
                break
            page += 1
        except requests.exceptions.RequestException as e:
            logger.error(f'Failed to fetch Vanta controls: {str(e)}')
            raise

    logger.info(f'Fetched {len(failed_controls)} failed Vanta controls')
    return failed_controls

def create_jira_remediation_ticket(control: Dict) -> Optional[str]:
    \\\"\\\"\"Create a Jira ticket for a failed Vanta control with SOC 2 required metadata.\\\"\\\"\"
    try:
        jira_client = JIRA(
            server=JIRA_SERVER,
            basic_auth=(JIRA_USER, JIRA_API_TOKEN)
        )

        # Format control details for Jira ticket
        control_id = control.get('id')
        control_name = control.get('name', 'Unknown Control')
        control_description = control.get('description', 'No description provided')
        remediation_steps = control.get('remediation_steps', [])
        severity = control.get('severity', 'Medium')

        issue_dict = {
            'project': {'key': JIRA_PROJECT_KEY},
            'issuetype': {'name': JIRA_REMEDIATION_ISSUE_TYPE},
            'summary': f'[SOC2] Remediate Failed Control: {control_name}',
            'description': f'''
            *Auto-generated from Vanta 2.0 failed control*

            *Control ID:* {control_id}
            *Severity:* {severity}
            *Framework:* SOC 2 Type II
            *Due Date:* {(datetime.now() + timedelta(days=7)).strftime('%Y-%m-%d')}

            *Description:*
            {control_description}

            *Remediation Steps:*
            {chr(10).join([f'{{quote}} {step}' for step in remediation_steps])}

            *Vanta Control Link:* {control.get('url', 'N/A')}
            ''',
            'priority': {'name': 'High' if severity == 'Critical' else 'Medium'},
            'labels': ['soc2', 'vanta-automated', 'remediation']
        }

        new_issue = jira_client.create_issue(fields=issue_dict)
        logger.info(f'Created Jira ticket {new_issue.key} for control {control_id}')
        return new_issue.key
    except JIRAError as e:
        logger.error(f'Failed to create Jira ticket for control {control.get('id')}: {str(e)}')
        return None
    except Exception as e:
        logger.error(f'Unexpected error creating Jira ticket: {str(e)}')
        return None

def main():
    logger.info('Starting Vanta 2.0 to Jira remediation sync')
    try:
        failed_controls = get_vanta_failed_controls()
        if not failed_controls:
            logger.info('No failed controls found, exiting')
            return

        successful_tickets = 0
        for control in failed_controls:
            ticket_key = create_jira_remediation_ticket(control)
            if ticket_key:
                successful_tickets += 1

        logger.info(f'Sync complete: {successful_tickets}/{len(failed_controls)} tickets created')
    except Exception as e:
        logger.error(f'Main process failed: {str(e)}')
        sys.exit(1)

if __name__ == '__main__':
    main()

# Terraform configuration for AWS SOC 2 baseline controls
# Automatically ingested by Vanta 2.0 for evidence collection
# Version: 1.2.0 (aligned with Vanta 2.0 AWS integration spec)

terraform {
  required_version = \">= 1.6.0\"
  required_providers {
    aws = {
      source  = \"hashicorp/aws\"
      version = \"~> 5.0\"
    }
    vanta = {
      source  = \"vanta/vanta\"
      version = \"~> 2.0\"
    }
  }
  # Store state in S3 with encryption (SOC 2 requirement)
  backend \"s3\" {
    bucket         = \"our-company-terraform-state\"
    key            = \"soc2-baseline/terraform.tfstate\"
    region         = \"us-east-1\"
    encrypt        = true
    kms_key_id     = \"arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012\"
  }
}

# Configure AWS provider with required SOC 2 regions
provider \"aws\" {
  region = \"us-east-1\"
  # Enable default tags for all resources (Vanta uses these for asset inventory)
  default_tags {
    tags = {
      Environment = \"production\"
      ManagedBy   = \"terraform\"
      SOC2Scope   = \"true\"
      VantaOrgID  = var.vanta_org_id
    }
  }
}

# Configure Vanta 2.0 provider for control mapping
provider \"vanta\" {
  api_key = var.vanta_api_key
  org_id  = var.vanta_org_id
}

# Variables
variable \"vanta_org_id\" {
  type        = string
  description = \"Vanta 2.0 Organization ID (from Vanta dashboard)\"
  sensitive   = true
}

variable \"vanta_api_key\" {
  type        = string
  description = \"Vanta 2.0 API Key (read-only recommended)\"
  sensitive   = true
}

variable \"allowed_aws_regions\" {
  type        = list(string)
  description = \"AWS regions approved for SOC 2 scope\"
  default     = [\"us-east-1\", \"us-west-2\"]
}

variable \"admin_role_arns\" {
  type        = list(string)
  description = \"ARNs of IAM roles with admin access (for Vanta exception tracking)\"
  default     = []
}

# IAM Password Policy (SOC 2 Requirement: AC-7, IA-5)
resource \"aws_iam_account_password_policy\" \"soc2_policy\" {
  minimum_password_length        = 14
  require_lowercase_characters   = true
  require_uppercase_characters   = true
  require_numbers                = true
  require_symbols                = true
  allow_users_to_change_password = true
  max_password_age               = 90
  password_reuse_prevention      = 24
  hard_expiry                    = false
}

# AWS Config (required for Vanta to collect configuration evidence)
resource \"aws_config_configuration_recorder\" \"soc2_recorder\" {
  name     = \"soc2-config-recorder\"
  role_arn = aws_iam_role.config_role.arn

  recording_group {
    all_supported                 = true
    include_global_resource_types = true
  }
}

resource \"aws_config_delivery_channel\" \"soc2_delivery\" {
  name           = \"soc2-config-delivery\"
  s3_bucket_name = aws_s3_bucket.config_bucket.bucket
  s3_key_prefix  = \"config\"
  snapshot_delivery_properties {
    delivery_frequency = \"Six_Hours\"
  }
  depends_on = [aws_config_configuration_recorder.soc2_recorder]
}

resource \"aws_s3_bucket\" \"config_bucket\" {
  bucket        = \"our-company-aws-config-soc2-${data.aws_caller_identity.current.account_id}\"
  force_destroy = false

  tags = {
    Name = \"SOC2 AWS Config Bucket\"
  }
}

resource \"aws_s3_bucket_server_side_encryption_configuration\" \"config_bucket_encryption\" {
  bucket = aws_s3_bucket.config_bucket.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = \"AES256\"
    }
  }
}

# IAM Role for Config to write to S3
resource \"aws_iam_role\" \"config_role\" {
  name = \"aws-config-soc2-role\"

  assume_role_policy = jsonencode({
    Version = \"2012-10-17\"
    Statement = [
      {
        Action = \"sts:AssumeRole\"
        Effect = \"Allow\"
        Principal = {
          Service = \"config.amazonaws.com\"
        }
      }
    ]
  })
}

resource \"aws_iam_role_policy_attachment\" \"config_policy\" {
  role       = aws_iam_role.config_role.name
  policy_arn = \"arn:aws:iam::aws:policy/service-role/AWS_ConfigRole\"
}

# Vanta 2.0 AWS Integration (automatically maps controls to AWS resources)
resource \"vanta_aws_integration\" \"main\" {
  aws_account_id = data.aws_caller_identity.current.account_id
  regions        = var.allowed_aws_regions
  role_arn       = aws_iam_role.vanta_integration_role.arn
}

# IAM Role for Vanta to read AWS resources (read-only)
resource \"aws_iam_role\" \"vanta_integration_role\" {
  name = \"vanta-soc2-integration-role\"

  assume_role_policy = jsonencode({
    Version = \"2012-10-17\"
    Statement = [
      {
        Action = \"sts:AssumeRole\"
        Effect = \"Allow\"
        Principal = {
          AWS = \"arn:aws:iam::123456789012:root\" # Vanta's AWS account ID (from Vanta docs)
        }
        Condition = {
          StringEquals = {
            \"sts:ExternalId\" = var.vanta_org_id
          }
        }
      }
    ]
  })
}

resource \"aws_iam_role_policy\" \"vanta_read_only\" {
  name = \"vanta-soc2-read-only-policy\"
  role = aws_iam_role.vanta_integration_role.id

  policy = jsonencode({
    Version = \"2012-10-17\"
    Statement = [
      {
        Action = [
          \"config:Get*\",
          \"ec2:Describe*\",
          \"s3:Get*\",
          \"iam:Get*\",
          \"cloudtrail:Get*\",
          \"rds:Describe*\"
        ]
        Effect   = \"Allow\"
        Resource = \"*\"
      }
    ]
  })
}

# Data source to get current AWS account ID
data \"aws_caller_identity\" \"current\" {}

# Outputs for Vanta verification
output \"vanta_integration_status\" {
  value = vanta_aws_integration.main.integration_status
}

output \"config_recorder_status\" {
  value = aws_config_configuration_recorder.soc2_recorder.status
}

const fetch = require('node-fetch');
const fs = require('fs/promises');
const path = require('path');
const { createLogger, format, transports } = require('winston');
require('dotenv').config();

// Configure Winston logger for audit-compliant logging
const logger = createLogger({
  level: 'info',
  format: format.combine(
    format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }),
    format.json()
  ),
  transports: [
    new transports.File({ filename: 'vanta-report-generator.log' }),
    new transports.Console()
  ]
});

// Vanta API configuration
const VANTA_API_BASE = 'https://api.vanta.com/v2';
const VANTA_API_KEY = process.env.VANTA_API_KEY;
const VANTA_ORG_ID = process.env.VANTA_ORG_ID;

// Report configuration
const REPORT_OUTPUT_DIR = process.env.REPORT_DIR || './soc2-reports';
const REPORT_FRAMEWORK = 'SOC2_TYPE_II';
const EVIDENCE_TYPES = ['policy', 'technical_control', 'training_record'];

// Validate required environment variables
const requiredEnvVars = ['VANTA_API_KEY', 'VANTA_ORG_ID'];
const missingEnvVars = requiredEnvVars.filter(varName => !process.env[varName]);
if (missingEnvVars.length > 0) {
  logger.error(`Missing required environment variables: ${missingEnvVars.join(', ')}`);
  process.exit(1);
}

/**
 * Fetch all evidence for a given framework from Vanta 2.0 API with pagination
 * @returns {Promise} List of evidence objects
 */
async function fetchVantaEvidence() {
  const evidence = [];
  let page = 1;
  const perPage = 100;
  const headers = {
    'Authorization': `Bearer ${VANTA_API_KEY}`,
    'Content-Type': 'application/json'
  };

  while (true) {
    try {
      logger.info(`Fetching evidence page ${page}`);
      const response = await fetch(
        `${VANTA_API_BASE}/organizations/${VANTA_ORG_ID}/evidence`,
        {
          method: 'GET',
          headers,
          params: {
            page,
            per_page: perPage,
            framework: REPORT_FRAMEWORK,
            types: EVIDENCE_TYPES.join(',')
          }
        }
      );

      if (!response.ok) {
        const errorText = await response.text();
        throw new Error(`Vanta API error: ${response.status} ${errorText}`);
      }

      const data = await response.json();
      const pageEvidence = data?.evidence || [];
      evidence.push(...pageEvidence);

      // Stop if no more pages
      if (pageEvidence.length < perPage) break;
      page++;
    } catch (error) {
      logger.error(`Failed to fetch evidence page ${page}: ${error.message}`);
      throw error;
    }
  }

  logger.info(`Total evidence items fetched: ${evidence.length}`);
  return evidence;
}

/**
 * Group evidence by control ID for auditor-friendly reporting
 * @param {Array} evidenceList - Raw evidence from Vanta API
 * @returns {Object} Evidence grouped by control ID
 */
function groupEvidenceByControl(evidenceList) {
  return evidenceList.reduce((acc, evidenceItem) => {
    const controlId = evidenceItem.control_id || 'unmapped';
    if (!acc[controlId]) {
      acc[controlId] = {
        control_id: controlId,
        control_name: evidenceItem.control_name || 'Unknown Control',
        evidence_count: 0,
        evidence_items: []
      };
    }
    acc[controlId].evidence_count++;
    acc[controlId].evidence_items.push({
      id: evidenceItem.id,
      type: evidenceItem.type,
      created_at: evidenceItem.created_at,
      url: evidenceItem.url,
      status: evidenceItem.status
    });
    return acc;
  }, {});
}

/**
 * Generate HTML report for auditors
 * @param {Object} groupedEvidence - Evidence grouped by control
 * @returns {string} HTML report content
 */
function generateHtmlReport(groupedEvidence) {
  const controlRows = Object.values(groupedEvidence)
    .map(control => `

        ${control.control_id}
        ${control.control_name}
        ${control.evidence_count}
        View Evidence

    `)
    .join('');

  return `





        SOC 2 Type II Evidence Report
        Generated: ${new Date().toISOString()}
        Organization ID: ${VANTA_ORG_ID}
        Total Controls: ${Object.keys(groupedEvidence).length}


          ${controlRows}



            Control ID
            Control Name
            Evidence Count
            Sample Evidence Link






  `;
}

/**
 * Main execution function
 */
async function main() {
  try {
    logger.info('Starting SOC 2 evidence report generation');

    // Create output directory if it doesn't exist
    await fs.mkdir(REPORT_OUTPUT_DIR, { recursive: true });

    // Fetch evidence from Vanta
    const rawEvidence = await fetchVantaEvidence();
    if (rawEvidence.length === 0) {
      logger.warn('No evidence found for framework ' + REPORT_FRAMEWORK);
      return;
    }

    // Group evidence by control
    const groupedEvidence = groupEvidenceByControl(rawEvidence);

    // Generate HTML report
    const htmlReport = generateHtmlReport(groupedEvidence);

    // Write report to file
    const reportFileName = `soc2-evidence-report-${Date.now()}.html`;
    const reportPath = path.join(REPORT_OUTPUT_DIR, reportFileName);
    await fs.writeFile(reportPath, htmlReport, 'utf8');

    logger.info(`Report generated successfully: ${reportPath}`);

    // Generate summary JSON for CI/CD integration
    const summary = {
      report_path: reportPath,
      total_evidence: rawEvidence.length,
      total_controls: Object.keys(groupedEvidence).length,
      generated_at: new Date().toISOString()
    };
    await fs.writeFile(
      path.join(REPORT_OUTPUT_DIR, 'latest-summary.json'),
      JSON.stringify(summary, null, 2),
      'utf8'
    );
  } catch (error) {
    logger.error(`Report generation failed: ${error.message}`);
    process.exit(1);
  }
}

// Execute main function
if (require.main === module) {
  main();
}

// Short snippet to export Vanta policies to Confluence via API
const exportVantaPolicies = async () => {
  const policies = await vantaClient.policies.list({ framework: 'SOC2_TYPE_II' });
  policies.forEach(policy => {
    confluenceClient.content.create({
      type: 'page',
      title: `SOC2: ${policy.name}`,
      space: { key: 'SEC' },
      body: { storage: { value: policy.content, representation: 'wiki' } }
    });
  });
};

# GitHub Actions workflow snippet for Vanta compliance check
- name: Run Vanta Compliance Check
  uses: vanta/github-action@v2.0.0
  with:
    vanta-api-key: ${{ secrets.VANTA_API_KEY }}
    fail-on-violation: true
    scan-scope: pr-diff

# Curl command to list Vanta 2.0 marketplace auditors
curl -X GET \"https://api.vanta.com/v2/marketplace/auditors\" \
  -H \"Authorization: Bearer $VANTA_API_KEY\" \
  -H \"Content-Type: application/json\" \
  -d '{\"framework\": \"SOC2_TYPE_II\", \"org_size\": \"11-50\"}'