Monitor Inactive AWS IAM Users & Slack Alerts

This n8n workflow automates AWS IAM user monitoring by running weekly to identify users with no activity for over 90 days. It lists all IAM users, enriches details like password last used and access key usage, filters out invalid entries, and checks inactivity based on multiple date sources (PasswordLastUsed, AccessKeyLastUsed, or CreateDate fallback). Inactive users trigger Slack notifications, while active ones are silently ignored.

Key features include robust filtering for service-linked roles, precise 90-day threshold logic, and AWS SigV4 compatibility scoped to us-east-1. Setup requires AWS credentials with read-only IAM perms (ListUsers, GetUser) and Slack OAuth. No coding needed—import, configure creds, and activate.

Benefits: Enhances security posture by preventing dormant account risks, ensures compliance with hygiene standards, and saves manual audit time for SRE/DevOps teams, MSPs, and security owners. Ideal for multi-account AWS environments needing lightweight, automated alerting without complex tools.

Use cases: Regular IAM cleanup alerts, audit prep, cost optimization via unused access review, and proactive privilege management.