How do I collect evidence from AWS for SOC 2?

AWS Evidence by SOC 2 Control

SOC 2 Control	AWS Service	Evidence to Capture
Access controls (CC6.1)	IAM	User list with policies, MFA status, password policy settings
Access controls (CC6.1)	IAM	Root account MFA enabled, access key rotation
Data protection (CC6.7)	S3	Bucket policies, public access block settings, encryption config
Data protection (CC6.7)	RDS/DynamoDB	Encryption at rest settings, backup configuration
Change management (CC8.1)	CloudTrail	Audit logging enabled for all regions
Monitoring (CC7.2)	CloudWatch	Alarms configured for critical metrics
Network security (CC6.6)	VPC	Security group rules, NACLs for production subnets

Step-by-Step Collection

IAM Evidence

1. Screenshot the IAM Users page showing all users
2. Screenshot MFA status for each user (should show "Enabled")
3. Screenshot the password policy settings
4. Screenshot key IAM policies (especially any custom policies)
5. Verify root account has MFA enabled and no access keys

S3 Evidence

1. Screenshot "Block Public Access" settings (should be enabled at account level)
2. For each bucket with sensitive data, screenshot encryption settings
3. Screenshot bucket policies for production buckets

Database Evidence

1. Screenshot RDS instance details showing encryption enabled
2. Screenshot backup configuration (automated backups, retention period)
3. Screenshot security group allowing access only from your application

CloudTrail and CloudWatch

1. Screenshot CloudTrail showing trails enabled in all regions
2. Screenshot CloudWatch alarms for critical events
3. Show a sample CloudTrail log entry demonstrating audit logging works

Tips

• Only document services you use. Don't screenshot every AWS service — focus on what's in your SOC 2 scope.
• Use AWS Config if available. AWS Config provides continuous compliance monitoring and can generate evidence reports.
• Check for public exposure. Run the Trusted Advisor check or S3 access analyzer before the audit to catch publicly accessible resources.