AWS IAM Inactive User Alerting via Slack - n8n Workflow

Security and Compliance Officers requiring automated auditing.
DevOps Engineers and SRE teams focused on cloud security hygiene.
System Administrators who need to enforce least-privilege policies.
Users looking for powerful, recurring infrastructure monitoring n8n templates.

Maintaining proper Identity and Access Management (IAM) hygiene is crucial for cloud security. Dormant or inactive user accounts are frequently exploited security gaps. This comprehensive n8n workflow solves this problem by automating the auditing process.

Running on a scheduled n8n trigger, this flow periodically pulls all IAM user data from AWS, filters out users that have been inactive for more than 90 days, and sends a detailed, actionable alert to a designated Slack channel. Utilizing the dedicated AWS IAM n8n node and standard n8n logic features, this solution ensures continuous monitoring without manual intervention, significantly reducing security exposure and simplifying compliance reporting.

This powerful n8n workflow operates in a six-step process, starting with a scheduled n8n trigger:

1. Workflow Initiation: The Weekly scheduler n8n trigger activates the automation, typically once per week.


2. Retrieve All Users: The n8n node dedicated to AWS IAM fetches a list of all existing IAM user names in the configured AWS account.


3. Enrich User Data: The workflow iterates through the list, calling the Get user n8n node for each user to retrieve detailed information, including the PasswordLastUsed timestamp and ARN.


4. Data Filtering: A Filter bad data n8n node ensures that only users with usable login activity data (i.e., where PasswordLastUsed is not null) proceed down the path, effectively skipping service accounts that may not have console logins.


5. Inactivity Check: The If n8n node checks the last activity date against a time threshold (90 days). If the user's last login was before the 90-day mark, the user is deemed inactive.


6. Slack Notification: For every inactive user that meets the criteria, the Send a message n8n node posts a formatted warning to a specific Slack user or channel, detailing the user's name, ARN, and last activity time, prompting security review.

To deploy this security-focused n8n workflow, follow these steps:

1. Import: Copy the provided JSON data and import it directly into your n8n instance via the 'Workflows' menu using the 'New' -> 'Import from JSON' option.


2. AWS Credentials Setup: Create an AWS credential in n8n. Crucially, for IAM operations, the region must be set to us-east-1, regardless of where your other services run. Ensure the attached IAM policy grants iam:ListUsers and iam:GetUser permissions.


3. Slack Credentials Setup: Create or update your Slack OAuth2 credential. The associated Slack bot must have permission to post messages in the target channel or direct message user.


4. Configure Nodes:

1. Activate: Save the n8n workflow and set the toggle to 'Active'. The n8n trigger will now execute the monitoring process automatically.

Weekly scheduler (n8n trigger): Initiates the process. Configured to run at a weekly interval, ensuring regular security checks.
Get many users (AWS IAM n8n node): Function is ListUsers. Retrieves a list of all IAM users in the account.
Get user (AWS IAM n8n node): Function is Get user. Runs in a loop for each user returned, enriching the item with metadata like ARN and PasswordLastUsed.
Filter bad data (n8n node): Filters out data items where the PasswordLastUsed field does not exist, ensuring we only evaluate accounts that could potentially have console login history.
IAM user inactive for more than 90 days? (If n8n node): Core logic. Checks if the PasswordLastUsed date is older than the 90-day threshold, routing inactive users to the notification path.
Send a message (Slack n8n node): Sends a highly formatted warning message containing the User ARN and Name to a specific Slack recipient. This n8n node handles the final alerting action.