Get a Slack alert when AWS access keys are over a year old

Every week, the system checks AWS access keys and posts a Slack alert for any that are over a year old.

How the work actually flows

A straight line. Runs once per one per iam user.

Pattern: Sequence (1) ยท Multiple Instances with a priori Run-Time Knowledge (14)

flowchart TD trig(["weekly scheduled check"]):::trigtime s0[["list iam users and access keys"]]:::mi s1["flag keys older than a year"]:::task s2["post slack alert"]:::svc trig --> s0 s0 --> s1 s1 --> s2 out[/"slack alert of outdated keys"/]:::out pay{{"stay audit ready without manual checks"}}:::pay s2 --> out out --> pay classDef task fill:#e7f6fe,stroke:#34b8f0,color:#2c2a29 classDef svc fill:#f6f8fa,stroke:#7c8795,color:#2c2a29 classDef mi fill:#e7f6fe,stroke:#0079a8,color:#2c2a29,stroke-width:2px classDef human fill:#fff,stroke:#0079a8,color:#0079a8 classDef store fill:#f6f8fa,stroke:#0079a8,color:#2c2a29 classDef trig fill:#00a4eb,stroke:#0079a8,color:#fff,font-weight:bold classDef trigtime fill:#00a4eb,stroke:#0079a8,color:#fff,font-weight:bold classDef trigdata fill:#8ad4f5,stroke:#0079a8,color:#06314c,font-weight:bold classDef gate fill:#fff,stroke:#e8a23d,color:#6b4708,font-weight:bold classDef out fill:#1f9d6b,stroke:#167a53,color:#fff,font-weight:bold classDef pay fill:#06314c,stroke:#021f33,color:#fff
Starts itA stepAn outside serviceRuns once per itemResultPayoff
Build size
Advanced

A larger build with multiple systems, AI reasoning, and custom rules.

Business functions
Messaging & NotificationsDevOps & IT OperationsSecurity & Compliance
Connects
AWS IAMSlack

The problem it solves

You know old access keys are a security risk, but nobody has time to check every account by hand every week. Stale keys quietly pile up until an audit or a breach forces the issue.

Who it fits

IT, DevOps, or security teams responsible for keeping AWS accounts audit-ready.

How it works

  1. Every week, the system checks all IAM users in your AWS account
  2. It pulls the access keys for each user and filters out any that are inactive
  3. It flags any active key that was created more than 365 days ago
  4. It posts a Slack message listing the outdated keys for your team to rotate
What you get

Access keys rotated before they become a risk

You get a weekly alert listing any AWS access keys older than a year so your team can rotate them before they become a liability.

What you get

A Slack message listing which access keys need to be rotated.

What you need

An AWS account with IAM permissions and a Slack workspace with a bot able to post messages.

We can build this. But should you?

The hard question is not how to build it. It is whether this is the right thing to build first.

That is what a Fractional Chief AI Officer figures out with you, before anyone writes a line of code.

Let's Talk Strategy

Related automations

Enforce MFA and deactivate risky AWS access keys automatically

Every day, checks AWS users for missing MFA, disables their access keys, and alerts your team on Slack.

Standard

Alert your team in Slack about AWS users inactive over 90 days

Every week the system checks AWS accounts for users inactive over 90 days and posts a Slack alert for each one it finds.

Advanced

Scan pull requests for security vulnerabilities with AI

Every pull request gets reviewed by AI for security issues, with serious findings flagged to your team on Slack.

Advanced

Scan for security threats every 15 minutes and alert your team fast

Every 15 minutes, AI checks logs and threat feeds for risks and alerts your security team before they escalate.

Advanced
Back to the AI Playbook