Triage AWS Security Misconfigs with GPT-4o Mini & Gmail Alerts

This workflow ingests AWS security misconfigurations from Security Hub or AWS Config through EventBridge rules and SNS topics, delivering them to an n8n webhook. It handles SNS subscription confirmation automatically, normalizes findings (S3 buckets, Security Groups, IAM, RDS) into a consistent JSON format, and leverages GPT-4o mini to assign priorities (P0-P3), generate rationales, and suggest remediation steps.

Findings are upserted into Airtable to prevent duplicates and maintain an audit trail. High-priority alerts are formatted into compact incident summaries and emailed via Gmail, easily adaptable to Slack or Teams. This reduces manual triage time, minimizes alert fatigue, and ensures critical issues like public S3 buckets or overly permissive IAM policies are actioned promptly.

Ideal for DevOps, SecOps, and cloud teams managing AWS environments. Benefits include AI-powered risk scoring for faster response, centralized logging, and low-cost automation (mostly free with n8n CE). Setup takes 10-15 minutes for beginner-intermediate users with AWS permissions and n8n credentials for OpenAI, Airtable, and Gmail.