feat(terraform): add Gate/Prove Continuous Trust & Evidence Freshness policy

[AAH20]

Summary

Adds a native Gate/Prove Continuous Trust and Evidence Freshness policy check (CKV_AWS_399) for AWS Terraform resources (aws_config_configuration_recorder, aws_config_delivery_channel) to validate continuous drift monitoring and evidence freshness tracking for SOC 2 Type II (CC6.8, CC7.1) and ISO 27001 (A.12.1.2) compliance.

Problem Solved

Static Infrastructure-as-Code (IaC) security checks frequently evaluate Terraform files at a single point in time, but fail to enforce continuous drift detection and snapshot delivery frequency. In production, unmonitored infrastructure drifts over time, causing annual SOC 2 Type II audit failures when teams lack cryptographic proof of continuous compliance evidence freshness.

This check ensures:

1. never_equate_static_scan_to_runtime_compliance: true: Verifies that AWS Config configuration recorders capture all supported resource types (all_supported = true) or global resource types.
2. Evidence Freshness Tracking: Enforces periodic snapshot delivery frequency (One_Hour to TwentyFour_Hours), ensuring that audit evidence age does not exceed standard continuous compliance SLAs.
3. Compliance Mapping: Maps directly to SOC 2 Type II Trust Services Criteria (CC6.8, CC7.1) and ISO/IEC 27001:2013 (A.12.1.2).

Testing & Validation

• Added tests/terraform/checks/resource/aws/test_GateProveEvidenceFreshness.py verifying passing configurations for all_supported = true and valid delivery frequencies, as well as failing configurations for missing or disabled recording groups (all 4 unit tests passing).

Upstream & Commercial Context

Maintained by A2Z SOC for Continuous Trust, IaC drift intelligence, and audit readiness.

For organizations requiring automated cloud drift audits or SOC 2 / ISO 27001 readiness sprints:

• Instant Audit ($499): https://a2zsoc.com/productized-services#instant-audit-tripwire
• Advisory & GRC Sprints: https://a2zsoc.com/consultation