✓ Zero standing admin access, all access scoped and audited
✓ Policy violations eliminated with least-privilege roles
✓ SOC 2 Type I audit passed on the first attempt
Before → after
| Metric | Before | After |
|---|---|---|
| Standing admin access | By default | None |
| IAM policy violations | Recurring | 0 |
| SOC 2 audit | n/a | Passed |
A fintech marketplace was about to go through its first SOC 2 audit, and its cloud access was a mess, shared admin accounts, over-permissioned roles, and no audit trail.
The challenge
- Standing admin access everywhere, shared across the team.
- Over-permissioned roles with no least-privilege discipline.
- No audit logging, so the auditor couldn’t see who did what.
- MFA and org policies not enforced.
What we built
- Least-privilege roles rebuilt IAM around the minimum each role actually needs.
- Service accounts replaced human credentials for applications with tightly-scoped service accounts.
- Audit logging enabled Cloud Audit Logs with centralized export for the auditor.
- Org policies & MFA enforced MFA and guardrails across the entire organization.
- Infra as code codified all IAM in Terraform so changes are reviewed, not ad hoc.
The results
Standing admin access was eliminated, policy violations dropped to zero, and the SOC 2 Type I audit passed on the first attempt. The company now has an access model that scales with the team.
The takeaway
Security is boring by design. Least-privilege IAM, service accounts, and audit logs are the difference between passing an audit and failing one.
Stack Cloud IAMCloud Audit LogsOrg PoliciesTerraformMFA
“
We walked into the SOC 2 audit calm instead of scrambling, and passed on the first try.