Automated GitHub scanner for exposed AWS IAM keys

Automated GitHub Scanner for Exposed AWS IAM Keys

Overview

This n8n workflow automatically scans GitHub for exposed AWS IAM access keys associated with your AWS account, helping security teams quickly identify and respond to potential security breaches. When compromised keys are found, the workflow generates detailed security reports and sends Slack notifications with actionable remediation steps.

🔑 Key Features

- Automated AWS IAM Key Scanning: Regularly checks for exposed AWS access keys on GitHub - Real-time Security Alerts: Sends immediate Slack notifications when compromised keys are detected - Comprehensive Security Reports: Generates detailed reports with exposure information and risk assessment - Actionable Remediation Steps: Provides clear instructions for securing compromised credentials - Continuous Monitoring: Maintains ongoing surveillance of your AWS environment

📋 Workflow Steps

1. List AWS Users: Retrieves all users from your AWS account 2. Split Users for Processing: Processes each user individually 3. Get User Access Keys: Retrieves access keys for each user 4. Filter Active Keys Only: Focuses only on currently active access keys 5. Search GitHub for Exposed Keys: Scans GitHub repositories for exposed access keys 6. Aggregate Search Results: Consolidates and deduplicates search findings 7. Check For Compromised Keys: Determines if any keys have been exposed 8. Generate Security Report: Creates detailed security reports for compromised keys 9. Extract AWS Usernames: Extracts usernames from AWS response for notification 10. Format Slack Alert: Prepares comprehensive Slack notifications 11. Send Slack Notification: Delivers alerts with actionable information 12. Continue Scanning: Maintains continuous monitoring cycle

🛠️ Setup Requirements