{ "edges": [ { "to": "c6cddc58-555c-44d3-b970-3cd38b07c9f7", "from": "be83c2fb-d60b-4a66-86e8-8279f402e591", "toPort": "0", "fromPort": "0" }, { "to": "8d7beb4e-e725-47b9-bcc1-c4dd600fcb21", "from": "be83c2fb-d60b-4a66-86e8-8279f402e591", "toPort": "0", "fromPort": "1" }, { "to": "8fcd1f6d-8db8-4892-b1c7-1d85a720e822", "from": "a3783b1f-be0f-4993-9d8a-3f82c52d70cf", "toPort": "0", "fromPort": "0" }, { "to": "faa2591d-9d1f-46e5-ad8f-ba3a50baff43", "from": "af226c77-16df-4767-a19d-1724aeef2632", "toPort": "0", "fromPort": "0" }, { "to": "af226c77-16df-4767-a19d-1724aeef2632", "from": "e3f876c4-8933-4a10-9dda-7a871bef448c", "toPort": "0", "fromPort": "0" }, { "to": "e3f876c4-8933-4a10-9dda-7a871bef448c", "from": "9ee8a30b-7541-4f8b-ad69-d8dc9305adbc", "toPort": "0", "fromPort": "0" }, { "to": "be83c2fb-d60b-4a66-86e8-8279f402e591", "from": "faa2591d-9d1f-46e5-ad8f-ba3a50baff43", "toPort": "0", "fromPort": "0" }, { "to": "a3783b1f-be0f-4993-9d8a-3f82c52d70cf", "from": "c6cddc58-555c-44d3-b970-3cd38b07c9f7", "toPort": "0", "fromPort": "0" } ], "nodes": [ { "id": "9ee8a30b-7541-4f8b-ad69-d8dc9305adbc", "name": "Quarterly Schedule", "type": "trigger", "params": { "kind": "n8n-nodes-base.scheduleTrigger", "rule": { "interval": [ { "field": "cronExpression", "expression": "0 0 1 */3 *" } ] } }, "position": [ 4416, 2384 ] }, { "id": "e3f876c4-8933-4a10-9dda-7a871bef448c", "name": "Set Audit Data", "type": "code", "params": { "jsCode": "return {\n json: {\n auditType: 'User Access Review (UAR)',\n collectionTimestamp: new Date().toISOString()\n }\n};" }, "position": [ 4640, 2384 ] }, { "id": "af226c77-16df-4767-a19d-1724aeef2632", "name": "List IAM Users", "type": "integration", "params": { "service": "awsiam", "operation": "run", "__originalType": "n8n-nodes-base.awsIam", "requestOptions": {}, "additionalFields": {} }, "position": [ 4864, 2384 ] }, { "id": "faa2591d-9d1f-46e5-ad8f-ba3a50baff43", "name": "Format User Evidence", "type": "code", "params": { "jsCode": "const inputData = $input.all();\nconst auditData = $('Set Audit Data').first().json;\n\nlet users = [];\nif (inputData.length > 0 && inputData[0].json && inputData[0].json.Users) {\n users = inputData[0].json.Users;\n} else if (inputData.length > 0 && inputData[0].json && inputData[0].json.UserName) {\n users = inputData.map(item => item.json);\n}\n\nif (users.length === 0) {\n return [{ json: { username: 'NO_USERS_FOUND', auditDate: auditData.collectionTimestamp } }];\n}\n\nconst formatted = users.map(user => ({\n json: {\n username: user.UserName || 'N/A',\n userId: user.UserId || 'N/A',\n arn: user.Arn || 'N/A',\n createDate: user.CreateDate || 'N/A',\n auditDate: auditData.collectionTimestamp\n }\n}));\n\nreturn formatted;" }, "position": [ 5088, 2384 ] }, { "id": "be83c2fb-d60b-4a66-86e8-8279f402e591", "name": "Users Found?", "type": "if", "params": { "options": {}, "conditions": { "options": { "version": 1, "leftValue": "", "caseSensitive": true, "typeValidation": "strict" }, "combinator": "and", "conditions": [ { "id": "check", "operator": { "type": "string", "operation": "notEquals" }, "leftValue": "={{ $json.username }}", "rightValue": "NO_USERS_FOUND" } ] } }, "position": [ 5312, 2384 ] }, { "id": "c6cddc58-555c-44d3-b970-3cd38b07c9f7", "name": "Export to Google Sheets", "type": "integration", "params": { "service": "googleSheets", "operation": "append", "sheetName": { "__rl": true, "mode": "name", "value": "" }, "documentId": { "__rl": true, "mode": "id", "value": "" } }, "position": [ 5536, 2288 ] }, { "id": "a3783b1f-be0f-4993-9d8a-3f82c52d70cf", "name": "Summarize Run", "type": "code", "params": { "jsCode": "const totalCount = $input.all().length;\nconst auditDate = $('Set Audit Data').first().json.collectionTimestamp;\nreturn [{ json: { totalUsers: totalCount, auditDate: auditDate.split('T')[0] } }];" }, "position": [ 5760, 2288 ] }, { "id": "8fcd1f6d-8db8-4892-b1c7-1d85a720e822", "name": "Send Success Email", "type": "integration", "params": { "message": "=

AWS Access Review Complete

Hello,

Your quarterly AWS IAM User Access Review has been automatically executed and the evidence has been logged for SOC 2 compliance.

Active IAM Users Exported

Audit Date: {{ $json.auditDate }}

All user details have been appended to your connected Google Sheet.

Automated by n8n • SOC 2 Evidence Collector

", "options": {}, "service": "gmail", "subject": "✅ SOC 2 Audit: AWS Access Review Complete", "operation": "read" }, "position": [ 5984, 2288 ] }, { "id": "8d7beb4e-e725-47b9-bcc1-c4dd600fcb21", "name": "Send Warning Email", "type": "integration", "params": { "message": "=

⚠️ Audit Warning

Hello,

Your scheduled AWS IAM User Access Review just ran, but no users were found or the connection failed.

Troubleshooting Steps:

Check your AWS credentials in n8n.
Ensure the IAM user running this has the `iam:ListUsers` permission.

Please resolve this issue before your next auditor check-in.

Automated by n8n • SOC 2 Evidence Collector

", "options": {}, "service": "gmail", "subject": "⚠️ SOC 2 Audit Warning: No AWS Users Found", "operation": "read" }, "position": [ 5984, 2480 ] } ] }

AWS Access Review Complete

{{ $json.totalUsers }}

⚠️ Audit Warning

Troubleshooting Steps:

Collect SOC 2 AWS IAM evidence to Google Sheets with Gmail alerts