Step 2: Parse and Route Incoming SNS Events

Normalize SNS payloads and route subscription confirmations versus actual notifications.

1. Open SNS Event Parser and update the token check to your secret by replacing [CONFIGURE_YOUR_TOKEN] inside the code.
2. Verify the parser returns mode as either confirm or notify depending on the SNS event type.
3. Open Branch Logic and confirm the condition uses =={{ $json.mode === 'confirm' }} to branch confirmations from notifications.

Step 3: Handle SNS Subscription Confirmation

Confirm SNS subscriptions automatically when AWS sends a subscription confirmation event.

1. Open Confirm SNS Subscription and set URL to =={{ $json.subscribeUrl }}.
2. Open Compose Confirmation Response and ensure the response is assigned with =resp = { status: "subscribed", statusCode: $json.statusCode || 200 }.

Step 4: Normalize Findings and Run AI Severity Triage

Standardize security findings and classify priority using AI before storing and notifying.

1. Open Standardize Finding Data and keep Mode as runOnceForEachItem.
2. Confirm the code returns a single object with fields like finding_id, title, severity, and service.
3. Open AI Severity Triage and confirm the prompt includes {{ JSON.stringify($json, null, 2) }} for the normalized finding input.
4. Credential Required: Connect your openAiApi credentials in AI Severity Triage.

Step 5: Store Findings in Airtable

Upsert each triaged finding into Airtable for tracking and reporting.

1. Open Airtable Upsert Record and select your Base and Table.
2. Keep Operation set to upsert and map fields using the existing expressions, such as ={{ $('Standardize Finding Data').item.json.finding_id }} for the record ID.
3. Verify tags and remediation concatenation fields use the expressions shown in the node, for example ={{ $json.message.content.tags[0] }}{{ $json.message.content.tags[1] }}{{ $json.message.content.tags[2] }}{{ $json.message.content.tags[3] }}{{ $json.message.content.tags[4] }}.
4. Credential Required: Connect your airtableTokenApi credentials in Airtable Upsert Record.

Step 6: Configure Email Alerts and Webhook Reply

Send the triage summary to email and return a structured webhook response.

1. Open Dispatch Email Alert and set Send To to your recipient address (replace [YOUR_EMAIL]).
2. Confirm Subject uses =={{ `[${JSON.parse($node["AI Severity Triage"].json.message.content).priority}] ${$node["Standardize Finding Data"].json.title} — ${$node["Standardize Finding Data"].json.resource_id} (${ $node["Standardize Finding Data"].json.service })` }}.
3. Confirm Message uses the HTML template with AI remediation steps and embedded raw finding data: =={{ (() => { const nf = $node["Standardize Finding Data"].json; const ai = typeof $node["AI Severity Triage"].json.message.content === 'string' ? JSON.parse($node["AI Severity Triage"].json.message.content) : $node["AI Severity Triage"].json.message.content; const steps = (ai.remediation || []).map(s => `
4. ${s}
`).join(''); const tags = (ai.tags || []).join(', '); const airtableId = $node["Airtable Upsert Record"].json?.id || ''; const airtableLine = airtableId ? `

Airtable Record ID: ${airtableId}

` : ''; return `

AWS Misconfig Alert

Priority: ${ai.priority}   Severity: ${nf.severity}

Title: ${nf.title}

Service: ${nf.service}   Resource: ${nf.resource_id}

Account: ${nf.account}   Region: ${nf.region}

Why: ${ai.rationale}

Remediation:

${steps}

Tags: ${tags || '—'}

${airtableLine}
Raw finding

${JSON.stringify(nf.raw || nf, null, 2)}

`;})() }}.
5. Credential Required: Connect your gmailOAuth2 credentials in Dispatch Email Alert.
6. Open Build Webhook Reply and confirm Mode is raw with JSON Output set to ={{ { resp: { status: "processed", priority: $node["Airtable Upsert Record"].json.fields.Priority, finding_id: $node["Standardize Finding Data"].json.finding_id } } }}.

Step 7: Test and Activate Your Workflow

Validate end-to-end behavior before enabling production execution.

1. Click Execute Workflow and send a sample SNS notification payload to the Incoming Webhook Trigger URL.
2. Confirm that SNS Event Parser passes to Branch Logic, then to Standardize Finding Data for notification events.
3. Verify AI Severity Triage returns structured JSON and Airtable Upsert Record creates/updates a row.
4. Check that Dispatch Email Alert sends an email with the formatted summary and Build Webhook Reply returns a processed response.
5. Turn the workflow Active to start processing live SNS events.