# Automated AWS IAM key compromise response with Slack: n8n workflow

> Started by someone submitting a form, and works across Slack. It hands the judgement calls to Claude.

Source: https://millionrounds.com/workflow/automated-aws-iam-key-compromise-response-with-slack (Millionrounds; every figure on the page links to its filing or article)

[Automation library](https://millionrounds.com/workflows) · [Chat assistants](https://millionrounds.com/workflows?category=Chat+assistants#library)

# Automated AWS IAM key compromise response with Slack

Started by someone submitting a form, and works across Slack. It hands the judgement calls to Claude. 30 steps, 2 loops or waits: large, and worth reading before you trust it with anything live.

Large Calls a model: Claude

[Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fautomated-aws-iam-key-compromise-response-with-slack)

**30 steps** Large: read it before trusting it with anything live

**0** Branches: places the flow splits

**2** Loops or waits

**1** Service it connects to

## The flow

Starts it 2 Model 2 Logic 14 Service 12

The steps in the order they run, from what starts it.

- 1 **🧠 Claude AI Engine** Lm Chat Anthropic *Model*
- 2 **🔍 Manual Key Lookup Trigger** Manual trigger *Starts it*
- 3 **📝 Secure Form: Key Compromise Input** Form trigger *Starts it*
- 4 **🤖 AI Security Analysis** Agent *Model*
- 5 **🔍 AWS IAM Service** Aws Iam *Service*
- 6 **🔧 Process Form Submission** Set *Logic*
- 7 **💬 Notify Security Team** Slack *Service*
- 8 **🔑 Fetch User Access Keys** Http Request *Service*
- 9 **🔔 Request Human Approval** Slack *Service*
- 10 **📊 Parse Access Key Response** Code *Logic*
- 11 **✅ Approved Compromise Data** Set *Logic*
- 12 **⚡ No Operation, do nothing** No Op *Logic*
- 13 **🛡️ Generate Invalidation Policy** Http Request *Service*
- 14 **🚫 Deactivate Compromised Key** Http Request *Service*
- 15 **🔀 Merge Response Data** Merge *Logic*
- 16 **📜 Audit Inline Policies** Http Request *Service*
- 17 **🔍 Audit Attached Policies** Http Request *Service*
- 18 **🔗 Apply Security Policy** Http Request *Service*
- 19 **📦 Aggregate Final Results** Aggregate *Logic*
- 20 **📤 Extract Inline Policy Names** Split Out *Logic*
- 21 **📤 Extract Attached Policy List** Split Out *Logic*
- 22 **🔄 Batch Process Inline Policies** Split In Batches *Logic*
- 23 **🔄 Batch Process Attached Policies** Split In Batches *Logic*
- 24 **📜 Retrieve Inline Policy Details** Http Request *Service*
- 25 **📋 Fetch Policy Metadata** Http Request *Service*
- 26 **🔓 Parse Inline Policy JSON** Code *Logic*
- 27 **📄 Retrieve Policy Document** Http Request *Service*
- 28 **⚡ Inline Policy Router** No Op *Logic*
- 29 **🔓 Parse Attached Policy JSON** Code *Logic*
- 30 **⚡ Attached Policy Router** No Op *Logic*

## How it's built

- **Starts on:** Someone submitting a form
- **Steps:** 30, 2 loops or waits
- **Size:** Large: read it before trusting it with anything live
- **Connects to:** Slack
- **Model:** Claude

## Questions

What does it need to run?

An n8n account, plus your own Slack account, and a key for Claude. You connect your own accounts after importing it; none are included.

What starts it?

It starts on someone submitting a form.

Does it use AI?

Yes. It calls Claude. Model calls are billed by the provider, not by n8n.

How long does it take to set up?

Take your time. At 30 steps it is large: read it before trusting it with anything live.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

**Before you run it**

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 30 steps before you point it at anything that matters.

## Run it in n8n

- **Create your n8n account** Free to start. n8n is where the workflow runs. [Create an n8n account ↗](https://millionrounds.com/n8n)
- **Download the workflow** Free with a Millionrounds account. [Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fautomated-aws-iam-key-compromise-response-with-slack)
- **Paste it into n8n** Open a new workflow in n8n and paste. Then connect your own accounts.

Stored with the author's traces removed: canvas notes, instance identifiers, saved credential names and any live document they had left behind.

## Connects to

Each opens the other workflows that use it.

[Slack](https://millionrounds.com/workflows?service=Slack#library)

## Workflows like it

Also chat assistants, with the same services where possible, closest in size first.

- [**Intake Architect - Multi-Channel Professional Services Client** 31 steps · calls a model · Gmail, Google Sheets](https://millionrounds.com/workflow/intake-architect-multi-channel-professional-services-client)
- [**Record Property Maintenance Issues with Slack** 31 steps · calls a model · Gmail, Google Drive](https://millionrounds.com/workflow/record-property-maintenance-issues-with-slack)
- [**Score GeM tender compliance and draft bid responses** 29 steps · calls a model · Gmail, Google Sheets](https://millionrounds.com/workflow/score-gem-tender-compliance-and-draft-bid-responses)
- [**Send an executive morning brief with Jira and Gmail** 29 steps · calls a model · Gmail, Jira](https://millionrounds.com/workflow/send-an-executive-morning-brief-with-jira-and-gmail)
- [**Triage product UAT feedback with OpenAI and Jira** 29 steps · calls a model · Gmail, Google Sheets](https://millionrounds.com/workflow/triage-product-uat-feedback-with-openai-and-jira)
- [**AI-powered Scrum Master assistant with OpenAI and Slack** 28 steps · calls a model · Asana, Slack](https://millionrounds.com/workflow/ai-powered-scrum-master-assistant-with-openai-and-slack)