Triage AWS security misconfigurations with GPT-4.1 Mini and send alerts to Gmail

What this workflow does

Automatically triages risky AWS misconfigurations and alerts your team.

Pipeline: Security Hub or AWS Config -> EventBridge rules -> SNS (HTTP) -> n8n Webhook -> Normalize -> AI Prioritizer -> Airtable (log) -> Gmail (email)

- Normalizes incoming findings (S3 / Security Groups / IAM / RDS) into a consistent JSON. - Uses an LLM to assign a priority (P0–P3) with rationale and remediation steps. - Upserts the finding into Airtable (avoids duplicates). - Emails a compact incident summary to your inbox. This can be swapped for Microsoft Teams or Slack, etc.

Category: Security / Cloud / Alerting Time to set up: ~10–15 minutes Difficulty: Beginner–Intermediate Cost: Mostly free (n8n CE + AWS SNS/EventBridge; OpenAI + Airtable/Gmail as used)

----------

What you’ll need

- An n8n instance reachable over HTTP. - AWS account (one region) with permissions to create SNS topics and EventBridge rules. - Security Hub enabled (or AWS Config rules that emit compliance events). - n8n credentials: OpenAI, Airtable, Gmail.