AWS SOC 2 Compliance: What Auditors Actually Look For

SOC 2 auditors will ask about your AWS controls. Most teams scramble because they don't know what auditors actually test, or what evidence satisfies their requirements. Here's the uncomfortable truth about AWS SOC 2 compliance: using AWS does NOT automatically make you compliant. AWS being SOC 2 compliant means their infrastructure is compliant, not your applications running on it. Your auditor will want to see YOUR controls, using AWS SOC reports only as evidence of infrastructure compliance. This guide shows you exactly what to prepare. By the end, you'll know which controls are your responsibility versus AWS's, what evidence auditors expect for each Trust Service Criteria, common failure patterns to avoid, and a 90-day plan to get audit-ready. With 185 AWS services now in scope for SOC 2 (as of the Fall 2025 reports), the toolkit is comprehensive. The challenge isn't capability. It's knowing where to focus. Let's start with what auditors actually care about. What SOC 2 Auditors Expe