AWS Security Posture Change Triage with Claude & Slack Alerts

AWS security posture triage that turns finding changes into Slack alerts—with Claude risk assessment and manager approval

This n8n workflow automatically detects meaningful changes in your AWS security findings, enriches them with asset context, and uses Claude to determine impact and severity. Critical cases pause for security lead sign-off, while SecOps, Compliance, and stakeholders receive Slack alerts (plus Email and WhatsApp as configured).

What this workflow does

• Runs on a schedule (or manual trigger for testing) and loads AWS account ID, region, and notification configuration.
• Generates/fetches security findings and compares them against a saved baseline to detect meaningful changes.
• If no changes are found, the workflow stops early to reduce noise.
• Pulls asset inventory context (resources, IAM roles, environment details, VPCs) to help assess real-world relevance.
• Merges findings + asset context and sends them to a Claude-powered AI agent for security impact analysis and severity scoring.
• Parses Claude output into structured results (severity, summary, changed items, compliance impact, required actions).
• Routes critical-severity cases to a security lead for sign-off (pause/wait pattern). Approved cases proceed; rejected cases are flagged and alerted separately.
• For approved/reviewed items: updates the posture record, logs a compliance audit entry, notifies SecOps/Compliance (Slack, Email, WhatsApp), and saves the new baseline for the next cycle.

Use cases

• Detecting newly introduced high-risk AWS security findings after infrastructure changes.
• Reducing alert fatigue by only alerting when security posture changes meaningfully.
• Providing compliance-ready evidence by logging audit entries and capturing required actions from Claude.

Technical details

• Trigger: schedule trigger (manual run supported for testing).
• Logic + flow control: if, set, code, no op, wait.
• Notifications: Slack alerts (Email and WhatsApp as configured).
• AI risk analysis: Claude (Anthropic) “Security Impact Analysis Agent” with a structured, parsed output.
• Setup: configure AWS account ID, region, Anthropic model, connect Claude credentials, and review the agent prompt.