Collect SOC 2 evidence from GitHub, AWS, Google Workspace and Google

## SOC 2 Evidence Collector Collecting SOC 2 evidence by hand means screenshots, spreadsheets, and Slack threads every month. This workflow collects evidence automatically from GitHub, AWS IAM, and Google Workspace, appends findings to an evidence ledger in Google Sheets, and emails an auditor-ready PDF summary. ### How it works Three evidence arms run in parallel on the 1st of each month. GitHub covers access review (CC-6.1), AWS covers credential hygiene (CC-6.1, CC-6.2), and Workspace covers admin activity (CC-7.2, CC-6.1). If a source fails, that arm records an evidence_unavailable row with the fix instead of failing the run. Findings merge into one ledger, roll up per control, and Slack alerts only when a source failed. ### Setup 1. Create a Google Sheet (tab: Evidence) and a Drive folder for summaries. 2. Create a GitHub personal access token and an AWS access key, then connect an admin Google credential. 3. Fill Workflow Configuration with your org, sheet ID, folder ID, and notification email. 4. Run the Manual Test Trigger once, check the sheet and PDF, then activate the schedule. Caution: the GitHub token must belong to an organization owner with read:org scope, or the 2FA filter returns 403. Caution: the AWS credential needs only three read-only permissions: iam:GenerateCredentialReport, iam:GetCredentialReport, and iam:GetAccountSummary. Caution: connect an admin OAuth2 Google credential (scopes admin.reports.audit.readonly and admin.directory.user.readonly); service accounts need domain-wide delegation. Note: the AWS report is eventually consistent, so raise the wait for large accounts. ### Customization Adjust key age, lookback, and notifications in Workflow Configuration. No AI or paid services are used.