| name | code-to-control-mapper |
| description | Maps infrastructure code (Terraform, Kubernetes, CloudFormation) to compliance controls (ISO 27001, SOC 2, NIST 800-53). Analyzes IaC files and generates compliance evidence mappings showing which controls are satisfied. |
| allowed-tools | Bash, Read, Glob, Write, Edit |
Code-to-Control Mapper
Maps infrastructure-as-code (IaC) files to specific compliance framework controls. Translates technical implementations into audit-ready compliance evidence.
Quick Commands
Map a Terraform file to SOC 2:
node plugins/grc-engineer/scripts/map-control.js main.tf SOC2
Map Kubernetes manifests to ISO 27001:
node plugins/grc-engineer/scripts/map-control.js k8s/deployment.yaml ISO27001
Map CloudFormation template to NIST 800-53:
node plugins/grc-engineer/scripts/map-control.js template.yaml NIST80053
Supported Frameworks
- SOC2 - Service Organization Control 2 (CC6.1, CC7.2, etc.)
- ISO27001 - ISO/IEC 27001 (Annex A controls)
- NIST80053 - NIST Special Publication 800-53
- PCIDSS - Payment Card Industry Data Security Standard
- HIPAA - Health Insurance Portability and Accountability Act
- GDPR - General Data Protection Regulation
Supported IaC Formats
- Terraform (.tf, .tfvars)
- Kubernetes (.yaml, .yml)
- CloudFormation (.yaml, .json)
- Ansible (.yml)
- Pulumi (.ts, .js, .py)
Output Format
Generates markdown reports with:
- Control ID and description
- Evidence location (file:line)
- Compliance status (Satisfied/Partial/Not Satisfied)
- Recommendations for improvement
Example Output
# Compliance Mapping Report
## SOC 2 - CC6.1: Logical and Physical Access Controls
**Status:** ✅ Satisfied
**Evidence:**
- `main.tf:45` - `aws_db_instance` with `storage_encrypted = true`
- `main.tf:52` - IAM role with least privilege policy
**Mapping:** Data at rest encryption via AWS KMS satisfies encryption requirements.
Prerequisites
- IaC file to analyze
- Optional: Framework name (defaults to SOC2)
