Building a SOC 2 Evidence Collector: A Small-Team Alternative to Manual Audit Prep

Description and use

A small engineering team built an open‑source tool that automatically gathers SOC 2 evidence from AWS and GitHub, streamlining audit preparation.

Problem

Small engineering teams lack dedicated compliance staff, making SOC 2 evidence gathering manual, error‑prone, and time‑consuming.

Outcome

The tool identified 0 of 16 IAM users with MFA, 0 of 6 S3 buckets with public access blocked, and 0 of 14 repos with branch protection. After remediation, the tool correctly reported PASS for the fixed items, demonstrating accurate evidence collection and mapping.

Workflow

• 1. Deploy FastAPI backend with AWS and GitHub collectors
• 2. Configure AWS credentials (IAM user with read‑only access) and GitHub token (repo scope)
• 3. Trigger collection via dashboard or API call
• 4. Collect IAM MFA status, CloudTrail logging, S3 public‑access settings via boto3
• 5. Collect GitHub repo collaborator counts and branch‑protection rules via REST API
• 6. Map each finding to its SOC 2 Trust Service Criterion
• 7. Render results in readable tables on the dashboard
• 8. Review findings, remediate gaps (e.g., enable MFA, add branch protection), and re‑run collection to confirm fixes

Evidence

I built the SOC 2 Evidence Collector as a personal, open‑source project to explore that gap: a lightweight, read‑only tool that pulls access‑control, logging, and change‑management evidence directly from AWS and GitHub, and maps each finding to the specific SOC 2 Trust Service Criterion it satisfies.

Source

Initial AWS findings: IAM MFA enforcement (CC6.1) – 0 of 16 users had MFA enabled; CloudTrail logging (CC7.2) – PASS; S3 public access block (CC6.6) – 0 of 6 buckets had public access blocked.

Source

I then used the tool's own findings to remediate two specific gaps — enabling MFA on one IAM user and adding a branch‑protection rule to one repository — and re‑ran the collection to confirm the tool correctly detected the fix.

Source