See llms.txt for all machine-readable content.

Back to Templates

Collect SOC 2 evidence from GitHub, AWS, Google Workspace and Google

Created by

Created by: Ali Abdullah || ali-abdullahx1
Ali Abdullah

Last update

Last update 3 days ago

Categories

Quick overview

This workflow runs monthly to collect SOC 2 evidence from GitHub, AWS IAM, and Google Workspace, logs checks to a Google Sheets evidence ledger, generates a summary in Google Docs, exports it to PDF in Google Drive, emails it via Gmail, and posts a Slack alert if any source fails.

How it works

  1. Runs on a monthly schedule (or manually for testing) and loads configuration values like org IDs, lookback windows, and notification targets.
  2. Queries the GitHub API for organization members without 2FA and records a pass/fail (or “evidence_unavailable” with remediation details) for CC-6.1.
  3. Calls AWS IAM to generate and download the credential report, reads root MFA status, and evaluates IAM user MFA and access key age against the rotation threshold for CC-6.1 and CC-6.2.
  4. Pulls Google Workspace Admin audit logs for the configured lookback period and directory user 2-step verification enrollment to flag privileged actions (CC-7.2) and 2FA gaps (CC-6.1).
  5. Merges all findings into a single evidence set, appends each row to the “Evidence” tab in Google Sheets, and builds a per-control rollup with posture and top remediation items.
  6. Creates a Google Docs summary document, writes the compiled evidence summary into it, exports the document as a PDF from Google Drive, and emails it to the configured recipient via Gmail.
  7. Posts a warning message to Slack if any evidence source failed and had to emit “evidence_unavailable” rows.

Setup

  1. Create a Google Sheet with a tab named “Evidence,” then add Google Sheets credentials in n8n and set the Sheet ID and Drive folder ID in the workflow configuration.
  2. Add a GitHub personal access token that belongs to an organization owner with the read:org scope, and set your GitHub organization name in the workflow configuration.
  3. Add AWS credentials with permissions iam:GenerateCredentialReport, iam:GetCredentialReport, and iam:GetAccountSummary, and confirm the region and key age threshold values.
  4. Add a Google OAuth2 credential with admin scopes (admin.reports.audit.readonly and admin.directory.user.readonly), and set your Google customer ID and lookback days.
  5. Add Gmail credentials and set the notification email address, and add Slack credentials and set the target channel ID for failure alerts.