Automated GitHub scanner for exposed AWS IAM keys

by Niranjan G ✓ · 1,390 views · created 2025-06-18 · SecOps

What this workflow does

This workflow has 16 nodes and runs manually, when you click “Execute workflow”. Along the way it connects Slack. It also calls iam.amazonaws.com over HTTP.

How it runs

Trigger: Manually, when you click “Execute workflow”.

1. List AWS Users (HTTP Request): calls iam.amazonaws.com (POST)
2. Extract AWS Usernames (Code): runs custom JavaScript code
3. Split Users for Processing (Loop Over Items (Split in Batches)): loops over the items in batches
4. Get User Access Keys (HTTP Request): calls iam.amazonaws.com (POST)
5. Filter Active Keys Only (If): checks a condition and branches into true / false
6. Prepare Github Search (Code): runs custom JavaScript code
7. Rate Limit Wait (Wait): pauses before continuing
8. Search GitHub for Exposed Keys (HTTP Request): calls an HTTP API
9. Aggregate Search Results (Code): runs custom JavaScript code
10. Check For Compromised Keys (If): checks a condition and branches into true / false

…plus 4 more steps. See the full node list below.

Services it uses

Slack

HTTP calls to: iam.amazonaws.com

Before you upgrade to n8n 3.0

Nodes used (8)

• Manual Triggern8n-nodes-base.manualTrigger
• Loop Over Items (Split in Batches)n8n-nodes-base.splitInBatches
• HTTP Requestn8n-nodes-base.httpRequest
• Ifn8n-nodes-base.if
• Coden8n-nodes-base.code
• No Operation, do nothingn8n-nodes-base.noOp
• Slackn8n-nodes-base.slack
• Waitn8n-nodes-base.wait

From the author

Automated GitHub Scanner for Exposed AWS IAM Keys Overview This n8n workflow automatically scans GitHub for exposed AWS IAM access keys associated with your AWS account, helping security teams quickly identify and respond to potential security breaches. When…

View the original on n8n.io → Check your own copy