AWS Certificate Manager and Slack integration

Automated SSL/TLS Certificate Expiry Report for AWS > Automatically generates a weekly report of all AWS ACM certificates, including status, expiry dates, and renewal eligibility. The workflow formats the data into both Markdown (for PDF export to Slack) and HTML (for email summary), helping teams stay on top of certificate compliance and expiration risks. Who’s it for This workflow is designed for DevOps engineers, cloud administrators, and compliance teams who manage AWS infrastructure and need automated weekly visibility into the status of their SSL/TLS certificates in AWS Certificate Manager (ACM). It's ideal for teams that want to reduce the risk of expired certs, track renewal eligibility, and maintain reporting for audit or operational purposes. How it works / What it does This n8n workflow performs the following actions on a weekly schedule: Trigger: Automatically runs once a week using the Weekly schedule trigger. Fetch Certificates: Uses Get many certificates action from AWS Certificate Manager to retrieve all certificate records. Parse Data: Processes and reformats certificate data (dates, booleans, SANs, etc.) into a clean JSON object. Generate Reports: 📄 Markdown Report: Uses the Certificate Summary Markdown Agent (OpenAI) to generate a Markdown report for PDF export. 🌐 HTML Report: Uses the Certificate Summary HTML Agent to generate a styled HTML report for email. Deliver Reports: Converts Markdown to PDF and sends it to Slack as a file. Sends HTML content as a formatted email. How to set up Configure AWS Credentials in n8n to allow access to AWS ACM. Create a new workflow and use the following nodes in sequence: Schedule Trigger: Weekly (e.g., every Monday at 08:00 UTC) AWS ACM → Get many certificates Function Node → Parse ACM Data: Converts and summarizes certificate metadata OpenAI Chat Node (Markdown Agent) with a system/user prompt to generate Markdown Configure Metadata → Define file name and MIME type (.md) Create document file → Converts Markdown to document stream Convert to PDF Slack Node → Upload the PDF to a channel (Optional) Add a second OpenAI Chat Node for generating HTML and sending it via email Connect Output: Markdown report → Slack file upload HTML report → Email node with embedded HTML Requirements 🟩 n8n instance (self-hosted or cloud) 🟦 AWS account with access to ACM 🟨 OpenAI API key (for ChatGPT Agent) 🟥 Slack webhook or OAuth credentials (for file upload) 📧 Email integration (e.g., SMTP or SendGrid) 📝 Permissions to write documents (Google Drive / file node) How to customize the workflow Change report frequency**: Adjust the Weekly schedule trigger to daily or monthly as needed. Filter certificates**: Modify the function node to only include EXPIRED, IN_USE, or INELIGIBLE certs. Add tags or domains to include/exclude. Add visuals**: Enhance the HTML version with colored rows, icons, or company branding. Change delivery channels**: Replace Slack with Microsoft Teams, Discord, or Telegram. Send Markdown as email attachment instead of PDF. Integrate ticketing**: Create a JIRA/GitHub issue for each certificate that is EXPIRED or INELIGIBLE.

AWS Certificate Manager (ACM) Auto-Renew with Slack notify & approval Who’s it for SRE/DevOps teams managing many ACM certs. Cloud ops who want hands-off renewals with an approval step in Slack. MSPs that need auditable reminders and renewals on schedule. How it works / What it does Schedule Trigger – runs daily (or your cadence). Get many certificates – fetches ACM certs (paginate if needed). Filter: expiring in next 7 days – keeps items where: NotAfter before today + 7d NotBefore before today (already valid) Send message and wait for response (Slack) – posts a certificate summary and pauses until Approve/Reject. Renew a certificate – on Approve, calls the renew action for the item. How to set up Credentials AWS in n8n with permissions to list/read/renew certs. Slack OAuth (bot in the target channel). Schedule Trigger Set to run once per day (e.g., 09:00 local). Get many certificates Region: your ACM region(s). If you have several regions, loop regions or run multiple branches. Filter (IF / Filter node) Add these two conditions (AND): {{ $json.NotAfter.toDateTime('s') }} is before {{ $today.plus(7,'days') }} {{ $json.NotBefore.toDateTime('s') }} is before {{ $today }} Slack → Send & Wait Message (text input): :warning: ACM Certificate Expiry Alert :warning: Domain: {{ $json.DomainName }} SANs: {{ $json.SubjectAlternativeNameSummaries }} ARN: {{ $json.CertificateArn }} Algo: {{ $json.KeyAlgorithm }} Status: {{ $json.Status }} Issued: {{ $json.IssuedAt | toDate | formatDate("YYYY-MM-DD HH:mm") }} Expires: {{ $json.NotAfter | toDate | formatDate("YYYY-MM-DD HH:mm") }} Approve to start renewal. Add two buttons: Approve / Reject (the node will output which was clicked). Renew a certificate Map the CertificateArn from the Slack Approved branch. Requirements n8n (current version with Slack Send & Wait). AWS IAM permissions (read + renew ACM), e.g.: acm:ListCertificates, acm:DescribeCertificate, acm:RenewCertificate (plus region access). Slack bot with permission to post & use interactivity in the target channel. How to customize the workflow Window size:** change 7 to 14 or 30 days in the filter. Catch expired: add an OR path {{ $json.NotAfter.toDateTime('s') }} is before {{ $today }} → send a **red Slack alert. Auto-renew w/o approval:** bypass Slack and renew directly for low-risk domains. Multiple regions/accounts:** iterate over a list of regions or assume roles per account. Logging:** add a Google Sheet/DB append after Slack click with user, time, result. Escalation:** if no Slack response after N hours, ping @oncall or open a ticket. Notes The Slack node pauses execution until a button is clicked—perfect for change control. Time conversions above assume NotAfter/IssuedAt are Unix seconds ('s'). Adjust if your data differs.