How to Automate SOC 2 Evidence Collection with AWS

Overview

SOC 2 evidence collection consumes significant engineering time without automation — manual screenshot-taking, log exports, and configuration documentation can take 40–80 hours per year. AWS provides native services that, when configured to export evidence on a schedule, dramatically reduce this burden.

The automation target: set up once, run continuously throughout the observation period, and generate timestamped evidence automatically. When your auditor sends the PBC list, you have months of organised evidence ready to share.

Security Hub Evidence Automation

AWS Security Hub provides continuous compliance scoring against CIS AWS Foundations Benchmark v2.0, AWS Foundational Security Best Practices, and other standards. Set up weekly automated exports of your Security Hub summary score and critical findings.

Implementation: create an EventBridge rule that triggers every Sunday at 00:00 UTC. The rule invokes a Lambda function that calls the Security Hub GetComplianceSummaryByConfigRule API, formats the output as a JSON or CSV report, and stores it in an S3 evidence bucket with the date as the key prefix.

The result: 52 weekly compliance score snapshots per year showing consistent CIS Benchmark compliance. This is strong evidence for CC7.1 (configuration management) and can be shared with auditors as a folder of dated exports.

CloudTrail Automation

CloudTrail already generates logs continuously — automation here means making the evidence accessible and organised. Set up a monthly Lambda that: verifies CloudTrail is enabled in all regions, exports the CloudTrail configuration details (trail ARN, S3 bucket, validation status, encryption), and stores the configuration snapshot as a dated JSON file.

Also configure CloudTrail Insights to detect unusual API call volumes — these insights serve as additional monitoring evidence for CC7.2. Enable CloudTrail Insights from the trail settings and route alerts to CloudWatch for review.

AWS Config Automation

AWS Config continuously records resource configurations. Automate monthly Config compliance reports using the GetComplianceSummaryByConfigRule API to export a summary of all Config Rules with compliance status.

Set up Config notifications via SNS to SQS to Lambda for Config rule failures. When a rule fails (e.g. a security group is opened to 0.0.0.0/0), Lambda creates a Jira ticket with details, triggering your change management and vulnerability management workflows.

Building an Evidence Pipeline

An evidence pipeline is an EventBridge-triggered Lambda that collects multiple evidence types on a schedule and stores them in an organised S3 evidence bucket. Sample pipeline structure: EventBridge cron (weekly) to Lambda function to collect Security Hub score, IAM credential report, GuardDuty summary, and Config compliance status, then format and store in S3 at your-soc2-evidence/[year]/[week]/.

The IAM credential report is particularly valuable: it exports a CSV of all IAM users with MFA status, last activity, access key age, and password age. Generating this weekly creates a record of your MFA compliance status throughout the observation period.

Connect this to AuditPath via the API to automatically mark the MFA control as evidenced each week.

What Cannot Be Automated

Process evidence requires human activities: access reviews (you still need a human to verify each user is appropriate), vendor reviews (the decision about vendor risk requires human judgement), incident post-mortems (the analysis and lessons-learned are inherently human), and change management approvals (pull request reviews are human judgements).

Policy-related evidence cannot be automated: policy documents require human writing, approval, and acknowledgement.

The right model: automate all infrastructure and configuration evidence (targeting 60–70% of your total evidence requirements), and build systematic human processes for the remainder.