n8n Workflow: Collect SOC 2 & ISO 27001 Evidence (GitHub, AWS, Google)

Run a monthly SOC 2 + ISO 27001 evidence collection check across GitHub, Google, and AWS—then share the gaps to Slack.

This n8n workflow automatically gathers compliance-relevant evidence from GitHub, Google Workspace (Admin SDK Directory), and AWS IAM, logs results into Google Sheets, archives a period-stamped JSON snapshot to Google Drive, and posts an OpenAI-generated compliance gap digest to Slack.

What this workflow does

• Runs monthly: scheduled for the 1st of every month at 6:00 AM.
• GitHub evidence: fetches all repositories in a GitHub organization, filters to active repos, and checks default-branch protection settings via the GitHub API.
• Google Workspace evidence: lists active users using the Google Admin SDK Directory API, evaluates 2-Step Verification enrollment and enforcement, including checks for admin accounts.
• AWS IAM evidence: generates and downloads an AWS IAM credential report, then evaluates root hardening, user MFA, access key rotation age, and stale accounts against configured policy thresholds.
• Control mapping + readiness stats: merges evidence, maps each check to SOC 2 and ISO 27001 control IDs, and calculates per-control and overall readiness.
• Reporting: appends evidence rows to an “Evidence Log” tab and upserts summaries into a “Control Dashboard” tab in Google Sheets.
• Archive + digest: saves a formatted JSON evidence snapshot to Google Drive and uses OpenAI to draft a monthly gap analysis posted to Slack.

Use cases

• Monthly internal audits for SOC 2 and ISO 27001 readiness using real operational evidence.
• Automating recurring compliance monitoring for SaaS operators that use GitHub, Google Workspace, and AWS IAM.
• Centralizing control dashboards and stakeholder updates through Google Sheets and Slack.

Technical details

• n8n schedule + workflow logic: set, code, wait, merge, slack, sticky note.
• Integrations: GitHub API (branch protection), Google Admin SDK Directory (2FA enforcement), AWS IAM credential report (MFA/root/access key rotation/stale accounts), Google Sheets, Google Drive, Slack, and OpenAI.