{"product_id":"aws-security-posture-change-alerts-with-claude-slack-n8n","title":"AWS Security Posture Change Alerts with Claude \u0026 Slack (n8n)","description":"\u003ch3\u003eAWS security posture changes, summarized with Claude and sent to Slack—automatically\u003c\/h3\u003e\n\u003cp\u003eThis n8n workflow continuously (or on-demand) detects changes in your AWS Security Hub\/Config findings snapshot, enriches them with asset inventory context, and uses \u003cstrong\u003eAnthropic Claude\u003c\/strong\u003e to produce a structured change summary, severity, and compliance impact—then routes alerts to \u003cstrong\u003eSlack\u003c\/strong\u003e (and compliance logging) for faster SecOps triage.\u003c\/p\u003e\n\n\u003ch3\u003eWhat this workflow does\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eSchedules or manual trigger\u003c\/strong\u003e to start an AWS security posture check.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eFetches the latest findings snapshot\u003c\/strong\u003e from a Security Hub\/Config proxy API endpoint via HTTP.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eCompares snapshot vs. a stored baseline\u003c\/strong\u003e kept in workflow static data and \u003cem\u003estops immediately\u003c\/em\u003e if nothing changed.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eDetects meaningful diffs\u003c\/strong\u003e and gathers resource context from an \u003cstrong\u003easset inventory\/CMDB API\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eCalls Anthropic Claude\u003c\/strong\u003e (via an AI Agent) with previous\/current snapshots and asset context to generate:\n    \u003cul\u003e\n      \u003cli\u003ea structured change summary\u003c\/li\u003e\n      \u003cli\u003eseverity assessment\u003c\/li\u003e\n      \u003cli\u003ecompliance frameworks impacted\u003c\/li\u003e\n      \u003cli\u003erequired actions\u003c\/li\u003e\n    \u003c\/ul\u003e\n  \u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eRoutes notifications based on severity\u003c\/strong\u003e: Critical findings go to a \u003cstrong\u003esign-off wait\u003c\/strong\u003e step; other severities are posted to a Slack review channel.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eOn approval (or for non-Critical)\u003c\/strong\u003e: updates the security posture record via HTTP, writes an audit entry to a compliance log API, notifies SecOps and Compliance in Slack, sends an email summary, and persists the new snapshot as the baseline.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eUse cases\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003eAlerting SecOps teams only when AWS Security Hub\/Config findings truly change.\u003c\/li\u003e\n  \u003cli\u003eProviding compliance-ready context (frameworks impacted + actions) for governance workflows.\u003c\/li\u003e\n  \u003cli\u003eReducing alert fatigue by stopping runs when snapshots are unchanged.\u003c\/li\u003e\n  \u003cli\u003eIntroducing human sign-off for Critical posture changes before updates are committed.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eTechnical details\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003en8n nodes\/logic\u003c\/strong\u003e: \u003cem\u003eif, set, code, no op, wait, slack\u003c\/em\u003e\n\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eIntegrations\u003c\/strong\u003e:\n    \u003cul\u003e\n      \u003cli\u003eHTTP endpoints for Security Hub\/Config proxy findings snapshots\u003c\/li\u003e\n      \u003cli\u003eAsset inventory\/CMDB API for account and resource context\u003c\/li\u003e\n      \u003cli\u003eAnthropic Claude via an AI Agent for structured severity\/compliance change assessment\u003c\/li\u003e\n      \u003cli\u003eSlack for review and SecOps\/Compliance notifications\u003c\/li\u003e\n      \u003cli\u003eHTTP-based compliance logging and security posture record updates\u003c\/li\u003e\n    \u003c\/ul\u003e\n  \u003c\/li\u003e\n\u003c\/ul\u003e","brand":"N8N Commerce","offers":[{"title":"Default Title","offer_id":45967589834931,"sku":"N8N-19257","price":68.99,"currency_code":"GBP","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0749\/6279\/6723\/files\/P_FyDoWfP2pvE8ve2qpiy_FnB7Insi.png?v=1788685911","url":"https:\/\/buyflowscripts.com\/products\/aws-security-posture-change-alerts-with-claude-slack-n8n","provider":"N8N Commerce","version":"1.0","type":"link"}