Automate SOC 2 evidence collection by exporting audit logs and access reviews from cloud provider APIs

Steps

1. Identify the SOC 2 trust service criteria (CC6, CC7, CC9 are most relevant to technical evidence) and map each criterion to a specific data source (CloudTrail, GCP Audit Logs, Okta System Log, GitHub Audit Log)
2. Script periodic exports: for AWS use `cloudtrail:LookupEvents` filtered by event source and time range; for GCP use the Logging API `entries.list` method with a suitable filter
3. Store exported logs in an append-only, versioned object store (e.g., S3 with Object Lock) to preserve tamper-evident evidence
4. Generate access review reports by querying your IdP (Okta, Azure AD) for group memberships and comparing them to the authorized access list in your HR system
5. Package evidence files with metadata (collection date, source system, SHA-256 hash) into a structured evidence archive uploaded to your GRC platform (Vanta, Drata, Secureframe, etc.)