Automated AWS IAM key compromise response with Slack & Claude AI
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This AI workflow has 30 nodes and runs manually, when you click “Execute workflow” (plus 1 other trigger). Along the way it connects Slack, Anthropic Chat Model and AWS IAM. It also calls iam.amazonaws.com over HTTP.
How it runs
Trigger: Manually, when you click “Execute workflow” (plus 1 other trigger).
- AWS IAM: uses AWS IAM
- 🔧 Process Form Submission (Edit Fields (Set)): sets 3 fields: UserName, AccessKeyId, Date
- 🔑 Fetch User Access Keys (HTTP Request): calls iam.amazonaws.com (POST)
- 🔔 Request Human Approval (Slack): send and wait for a reply
- 📊 Parse Access Key Response (Code): runs custom JavaScript code
- ✅ Approved Compromise Data (Edit Fields (Set)): sets 3 fields: UserName, AccessKeyId, Date
- 🛡️ Generate Invalidation Policy (HTTP Request): calls iam.amazonaws.com (POST)
- 🚫 Deactivate Compromised Key (HTTP Request): calls iam.amazonaws.com (POST)
- Merge: merges the data from its input branches
- 📜 Audit Inline Policies (HTTP Request): calls iam.amazonaws.com (POST)
…plus 14 more steps. See the full node list below.
Services it uses
HTTP calls to: iam.amazonaws.com
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (14)
- HTTP Request
n8n-nodes-base.httpRequest - Code
n8n-nodes-base.code - Split Out
n8n-nodes-base.splitOut - Loop Over Items (Split in Batches)
n8n-nodes-base.splitInBatches - AI Agent
@n8n/n8n-nodes-langchain.agent - Merge
n8n-nodes-base.merge - Aggregate
n8n-nodes-base.aggregate - No Operation, do nothing
n8n-nodes-base.noOp - Slack
n8n-nodes-base.slack - Anthropic Chat Model
@n8n/n8n-nodes-langchain.lmChatAnthropic - AWS IAM
n8n-nodes-base.awsIam - Edit Fields (Set)
n8n-nodes-base.set - Manual Trigger
n8n-nodes-base.manualTrigger - n8n Form Trigger
n8n-nodes-base.formTrigger
From the author
🛡️ Automated AWS Key Compromise Remediation Description This n8n workflow provides a secure, enterprise-grade response system for AWS IAM access key compromises with built-in form submission and human approval mechanisms. When an AWS access key is suspected…