Monthly SOC 2 Evidence Collector for GitHub, AWS & Google

Monthly SOC 2 Evidence Collection for GitHub, AWS, and Google (Automated)

Keep your SOC 2 reporting on track: this monthly n8n workflow collects key SOC 2 evidence from GitHub, AWS IAM, and Google Workspace, logs results to Google Sheets, generates a Google Docs summary, exports a PDF, emails it via Gmail, and alerts Slack when evidence is unavailable.

What this workflow does

• Runs monthly (or on-demand for testing) and loads configuration like organization IDs, lookback windows, and notification targets.
• GitHub evidence for CC-6.1: queries the GitHub API for organization members without 2FA and records pass/fail. If data can’t be retrieved, it logs an evidence_unavailable row with remediation details.
• AWS IAM evidence for CC-6.1 and CC-6.2: generates and downloads the AWS IAM credential report, checks root MFA status, and evaluates IAM user MFA and access key age against your rotation threshold.
• Google Workspace evidence for CC-7.2 and CC-6.1: pulls Admin audit logs for the configured lookback period and checks 2-step verification enrollment for directory users to flag privileged actions and 2FA gaps.
• Rolls up findings: merges all results into one evidence set, appends rows to the “Evidence” tab in Google Sheets, and produces a per-control summary with posture and top remediation items.
• Creates reporting artifacts: writes the compiled summary to a Google Docs document, exports it to PDF in Google Drive, and emails it via Gmail.
• Slack alerting: posts a warning if any source fails and had to emit evidence_unavailable rows.

Use cases

• Automate recurring SOC 2 evidence gathering across GitHub, AWS, and Google Workspace.
• Ensure CC-6.1/CC-6.2/CC-7.2 evidence is consistently documented month over month.
• Get proactive Slack warnings when evidence can’t be collected, so gaps are remediated quickly.

Technical details

• Scheduler/config: monthly execution with support for manual runs.
• Google integrations: Google Sheets evidence ledger, Google Docs summary generation, Google Drive PDF export, Gmail email delivery.
• Logic & data handling: uses nodes such as if, set, code, and wait to evaluate findings and handle unavailable evidence states.
• Workflow output: PDF report + email, plus Slack alert if any checks fail.