AWS IAM n8n integrationAutomate AWS IAM with n8n.
Every IAM user and every group in your AWS account, handled from a workflow. The AWS IAM n8n integration exposes 12 operations across 2 resources, users and groups. No trigger node ships with it, so a Schedule Trigger or a Webhook starts the run. Written for ops and platform teams.
Verified Trustpilot reviews · AI, automation & growth agency
What does the AWS IAM n8n integration actually do?
The AWS IAM n8n integration wires the identity layer of your AWS account into the rest of your automation. n8n ships an AWS IAM node that talks to Amazon IAM directly: it creates, reads, updates and deletes users and groups, and it moves users in and out of groups. Twelve operations, two resources, and one AWS credential that every other AWS node in n8n can reuse.
Onboarding is usually the first thing a team moves over. A new hire row arrives from the HR side, user.create opens the IAM user with the name passed in User Name, and user.addToGroup drops that user into the group that already carries the right permissions. Set Path to something like /division_abc/engineering/ and the account still reads clearly a year later.
Offboarding runs the same sequence backwards, and it tends to be the one people care about most. user.removeFromGroup pulls the person out of each group, user.delete closes the account, and a note lands in Slack so the security channel keeps a written trace. Nothing sits in a ticket queue waiting for a human.
The third pattern is the access review. Run user.getAll with Return All turned on, then group.getAll with Include Users switched on, and write both results into Google Sheets on a schedule. One sheet then answers who sits in which group, which is the question every review opens with, and Gmail sends the reviewers their reminder.
The published n8n templates for this node point the same way. One responds to a compromised access key with Slack, Code and an AI agent. One alerts Slack about access keys older than 365 days. One collects SOC 2 evidence into Google Sheets with Gmail alerts. In all three, the AWS IAM node sits next to other nodes rather than doing the whole job alone.
Worth knowing before you design around it: anything outside the 12 catalog operations goes through the HTTP Request node, which calls any endpoint of the AWS API and reuses the same AWS credential through predefined authentication. If the platform choice itself is still open, the n8n review covers it, and the n8n training walks through building flows like these end to end.
How do you connect AWS IAM to n8n?
- 01
Create the access key in the IAM console
Sign in to the IAM console, select your user name in the navigation bar on the upper right, then Security credentials. In the Access keys section, select Create access key. On the access key best practices and alternatives page, choose your use case, or select Other if nothing prompts you to create a key, then select Next.
- 02
Name the key and reveal both values
Set a description tag on the key so you can identify it later,
n8n integrationworks well. Select Create access key, then reveal the Access Key ID and the Secret Access Key. Both are generated at that moment. Access keys can also be generated through the AWS CLI and the AWS API if you would rather script this step. - 03
Save the credential in n8n and pick it in the node
In n8n, open the Credentials menu and create an AWS (IAM) credential, meaning a stored set of connection details n8n reuses across workflows. Select your AWS Region, paste the Access Key ID and the Secret Access Key, and save. The AWS IAM node then offers that credential in its dropdown, along with every other AWS node in your instance.
What can the AWS IAM node do?
The AWS IAM node exposes 12 operations across 2 resources. For each one: the node as you configure it in n8n, the required fields, and our field notes.
| Resource | Create | Get | Get Many | Update | Delete | Add to Group | Remove From Group |
|---|---|---|---|---|---|---|---|
| User | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Group | ✓ | ✓ | ✓ | ✓ | ✓ |
User
7 operationsAdd user to group
user.addToGroupWhat you see in n8n
Notes & use cases
Group membership is where permissions actually land, and this operation adds an existing user to an existing group in one call.
Key parameters
- User: select the user you want to add to the group. It is a resource locator, so you can pick from the list n8n loads or feed an expression such as
{{ $json.userName }}from the step before. - Group: select the group you want to add the user to, the same way.
Create user
user.createWhat you see in n8n
Notes & use cases
Opens a new IAM user in the account. This is the operation an onboarding workflow starts with, before any group is attached.
Key parameters
- User Name: required, the username of the new user, for example
UserName. Leave it empty and the node stops on that item. - Path: the path for the user name, such as
/division_abc/subdivision_xyz/, useful once several teams share the account. - Permissions Boundary: the ARN of the managed policy used as the boundary, for example
arn:aws:iam::123456789012:policy/ExampleBoundaryPolicy. - Tags: a list of tags to attach to the new user.
Delete user
user.deleteWhat you see in n8n
Notes & use cases
Removes the user from IAM. There is no soft state here, so most teams put an approval step in front of it.
Key parameters
- User: select the user you want to delete. Picking from the list avoids the classic mistake of passing a display name where the node expects the user it loaded.
Get user
user.getWhat you see in n8n
Notes & use cases
Reads one user back from IAM and hands the record to the next node, which is what you want before deciding anything about that account.
Key parameters
- User: select the user you want to retrieve. Feeding it from a previous node with an expression turns the call into a lookup rather than a hard-coded one.
Get many users
user.getAllWhat you see in n8n
Notes & use cases
Returns the list of users in the account. Every inventory, review and reconciliation workflow starts here.
Key parameters
- Return All: on, n8n walks through the API pages and brings back every user; off, it stops at the number set in Limit.
- Limit: the maximum number of users returned when Return All stays off, handy while you are still testing.
- Path Prefix: filters the results on the path, so
/division_abc/gives you one division instead of the whole account.
Remove user from group
user.removeFromGroupWhat you see in n8n
Notes & use cases
Takes a user out of a group. The account stays open, the permissions that came with that group go away.
Key parameters
- User: select the user you want to remove from the group.
- Group: select the group you want to remove the user from. Both are resource locators, so a loop over a list of groups works well here.
Update user
user.updateWhat you see in n8n
Notes & use cases
Renames an existing user, and optionally moves it in the IAM path hierarchy.
Key parameters
- User: select the user you want to update, that is the account being changed.
- User Name: required, the new name of the user, for example
JohnSmith. It is the target name, not the current one. - Path: the new path, such as
/division_abc/subdivision_xyz/.
Group
5 operationsCreate group
group.createWhat you see in n8n
Notes & use cases
Creates a group, the container you attach users to instead of granting permissions one account at a time.
Key parameters
- Group Name: required, the name of the new group, for example
GroupName. - Path: the path to the group. Leave it out and it defaults to a slash,
/. Setting/division_abc/engineering/keeps the org chart visible in IAM itself.
Delete group
group.deleteWhat you see in n8n
Notes & use cases
Deletes an existing group. Teams usually run it at the end of a project cleanup, once the members have been moved elsewhere.
Key parameters
- Group: select the group you want to delete. Choose it from the list n8n loads rather than typing a label, since the node acts on the group it resolved.
Get group
group.getWhat you see in n8n
Notes & use cases
Retrieves the details of one existing group, with or without its membership.
Key parameters
- Group: select the group you want to retrieve.
- Include Users: on, the response also carries the list of users in the group, which saves a second call when you need the membership and not just the group itself.
Get many groups
group.getAllWhat you see in n8n
Notes & use cases
Lists the groups of the account, and can expand each one with its members in the same pass.
Key parameters
- Return All: on, n8n pages through the API until every group is back; off, it stops at Limit.
- Limit: caps the number of groups returned while Return All is off.
- Include Users: adds the list of users in each group, which is what turns this call into a full access map.
Update group
group.updateWhat you see in n8n
Notes & use cases
Changes the name of an existing group, and its place in the path hierarchy if you pass one.
Key parameters
- Group: select the group you want to update.
- Group Name: required, the new name of the group, for example
GroupName. - Path: the new path to the group; left out, it defaults to a slash,
/.
/division_abc/engineering/ so the next audit reads straight.Need help automating AWS IAM with n8n?
A person reads every message.
