Automated response to AWS key compromise with report in

This workflow automates incident response when AWS access keys are compromised. It deactivates keys, audits IAM policies, generates an AI-powered summary using Claude, and sends a structured report to Slack. The process requires manual approval via Slack before critical actions, reducing false positive risks. Ideal for DevOps engineers, cloud security specialists, and SOC teams managing AWS environments.

## Who it´s for
- DevOps engineers responsible for AWS security
- Cybersecurity professionals in cloud environments
- IAM administrators needing automated incident response
- SOC teams using Slack for coordination

## What the automation does
- Accepts compromise reports via web form or webhook
- Requests confirmation in Slack before executing actions
- Deactivates compromised AWS access keys
- Audits inline and attached IAM policies of the affected user
- Processes policies in batches, retrieves and decodes policy documents
- Aggregates findings and generates a summary using Claude AI
- Sends formatted report to designated Slack channel

## What´s included
- Ready-to-use n8n workflow
- Trigger and handler logic (webhook, form, manual trigger)
- Integrations with AWS IAM API, Slack API, and Anthropic (Claude)
- Basic text guide for deployment and adaptation

## Requirements for setup
- n8n instance with external API access
- AWS IAM account with permissions to manage access keys and policies
- Slack workspace with message send/read permissions
- Anthropic API key for accessing Claude model

## Benefits and outcomes
- Reduces incident response time to minutes
- Minimizes human error during emergency actions
- Full transparency: complete policy audit and AI-generated summary
- Seamless integration: all data delivered directly to Slack
- Scalable: reusable across different IAM users and teams
- Compatible: works within standard n8n + AWS + Slack stacks

## Important: template only
Important: you are purchasing a ready-made automation workflow template only. Rollout into your infrastructure, connecting specific accounts and services, 1:1 setup help, custom adjustments for non-standard stacks and any consulting support are provided as a separate paid service at an individual rate. To discuss custom work or 1:1 help, contact via в чате.