Evidence Collector Skill

Automated compliance evidence collection for AWS, GCP, and Azure cloud environments.

When to Activate

Activate this skill when the user:

• •Asks to collect compliance evidence
• •Mentions SOC 2, ISO 27001, NIST 800-53, or CIS benchmarks
• •Requests audit documentation or evidence packages
• •Wants to verify security configurations across cloud providers
• •Asks about IAM policies, logging, encryption, or network security evidence

Prerequisites

Before running evidence collection, ensure:

1. •

   AWS: Valid AWS credentials configured via:

   • •Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)
   • •AWS credentials file (~/.aws/credentials)
   • •IAM role (if running on EC2/Lambda)
   • •Required permissions: iam:Get*, iam:List*, cloudtrail:Describe*, cloudtrail:Get*, s3:GetBucket*, s3:ListBucket, securityhub:Get*, kms:Describe*, kms:List*, ec2:Describe*
2. •

   GCP: Valid GCP credentials configured via:

   • •Application Default Credentials (gcloud auth application-default login)
   • •Service account key file (GOOGLE_APPLICATION_CREDENTIALS)
   • •Required roles: roles/iam.securityReviewer, roles/logging.viewer, roles/storage.objectViewer, roles/securitycenter.findingsViewer, roles/cloudkms.viewer, roles/compute.viewer
3. •

   Azure: Valid Azure credentials configured via:

   • •Azure CLI (az login)
   • •Service principal environment variables
   • •Required roles: Reader, Security Reader, Key Vault Reader

Usage Patterns

Collect All Evidence for a Cloud Provider

from scripts.aws_evidence import AWSEvidenceCollector
from scripts.output_formatter import EvidenceFormatter

# Collect AWS evidence
collector = AWSEvidenceCollector()
package = collector.collect_all()

# Output as JSON
print(EvidenceFormatter.to_json(package))

# Output as Markdown report
print(EvidenceFormatter.to_markdown(package))

# Save to files
EvidenceFormatter.save(package, "./evidence_output")

Collect Specific Evidence Categories

from scripts.aws_evidence import AWSEvidenceCollector

collector = AWSEvidenceCollector()

# Collect only IAM evidence
iam_evidence = collector.collect_iam()

# Collect only logging evidence
logging_evidence = collector.collect_cloudtrail()

# Collect encryption evidence
encryption_evidence = collector.collect_kms()

Multi-Cloud Collection

from scripts.aws_evidence import AWSEvidenceCollector
from scripts.gcp_evidence import GCPEvidenceCollector
from scripts.azure_evidence import AzureEvidenceCollector
from scripts.output_formatter import EvidenceFormatter

# Collect from all providers
aws_package = AWSEvidenceCollector().collect_all()
gcp_package = GCPEvidenceCollector(project_id="my-project").collect_all()
azure_package = AzureEvidenceCollector(subscription_id="sub-id").collect_all()

# Save all packages
for package in [aws_package, gcp_package, azure_package]:
    EvidenceFormatter.save(package, "./evidence_output")

Evidence Categories

Each cloud provider collector gathers evidence in these categories:

Output Formats

JSON Output

Structured JSON following the schema in references/evidence_schema.json. Suitable for:

• •Automated processing
• •Integration with GRC tools
• •Long-term evidence storage

Markdown Output

Human-readable report with:

• •Metadata summary
• •Evidence grouped by category
• •Control mapping tables with status indicators
• •Suitable for auditor review and documentation

Control Framework Mappings

Evidence is automatically mapped to controls from:

• •SOC 2 Type II: CC (Common Criteria) series
• •ISO 27001: Annex A controls
• •NIST 800-53: Security and privacy controls
• •CIS Benchmarks: Cloud-specific benchmarks

See references/control_mappings.md for complete mapping details.

Error Handling

The collectors handle common errors gracefully:

• •Missing Permissions: Logs warning, continues with available data
• •API Rate Limits: Implements exponential backoff
• •Region Unavailable: Skips region, notes in output
• •Resource Not Found: Records as "not configured" evidence

Best Practices

1. •Run with least privilege: Use read-only credentials
2. •Scope appropriately: Collect only what you need for the audit
3. •Timestamp everything: Evidence is timestamped automatically
4. •Version control outputs: Store evidence packages in version control
5. •Review before submission: Always review collected evidence before sharing with auditors