Claude分析AWS安全变化并对接审批与合规日志

原文要点

该流程定时或手动调用Security Hub/Config类代理API取最新发现快照，与workflow static data基线比较，无变化即停；有差异再调资产清单/CMDB API补上下文，交Anthropic Claude输出结构化摘要、严重度、受影响合规框架和所需行动。Critical进Wait节点等signOffApproved回调，其他进Slack复核；通过后HTTP更新态势记录、写合规日志API、Slack与邮件通知并保存新基线。设置强调三个API base URL、AWS账号/region与Slack频道要替换。

这次做成什么

搭一条可演练的安全变化评审链：用隔离Mock API代替真实AWS代理，做到“无变化立即停、有差异让Claude评级、Critical必须审批回调、非Critical进复核”，最后写审计日志；不伪造AWS命令。

准备什么

• n8n实例、Anthropic凭据且账号可用所配置Claude模型
• Slack凭据与三个测试频道：review、secops、compliance
• SMTP或邮件凭据、三个HTTP Header Auth凭据指向Mock端点
• 隔离AWS账号/region标识与审批人测试邮箱，不用生产凭据

具体怎么做

1. 准备Mock接口

   用本地Mock服务或n8n Webhook模拟三类端点：GET /findings-snapshot、GET /asset-context、POST /compliance-log与POST /posture-record。原文未给真实API路径，以上只是练习占位；接入真实系统前按原模板HTTP节点逐项核对Header与路径。

2. 配置常量与凭据

   在配置处填aws_account_id、region、findings_api_base、asset_api_base、compliance_api_base、slack_review_channel、secops_channel、compliance_channel、email_from/to；HTTP Header Auth只放测试令牌。Anthropic节点选账号内可用模型，不新增作者未提模型名。

3. 实现快照对比

   Trigger后HTTP取current snapshot；Code节点规范化finding_id、severity、resource_id、status、updated_at并排序哈希，与workflow static data的baseline_hash比较。相同输出stopped=true并结束；不同则生成added/removed/changed三个数组继续。

4. 丰富上下文并让Claude评级

   对changed/added的resource_id批量调资产上下文，合并owner、env、data_classification、internet_exposed。把previous_snapshot、current_snapshot、diff、asset_context放入Claude提示词，要求只输出JSON；解析失败按非Critical转人工复核，不自动批准。

5. 分支审批与落账

   severity=Critical进Wait节点，复制其webhook URL给审批流程，回调体需含signOffApproved布尔；false则记 rejected 并通知。其余severity发Slack review。批准或非Critical后：POST posture-record、POST compliance-log、Slack通知secops/compliance、邮件摘要，最后把current snapshot写入static data作为新baseline。

可直接复制的材料

你是云安全变更评估员。仅依据输入JSON，不联网不臆测。输出严格JSON：{"change_summary":"120字内","severity":"Critical|High|Medium|Low","frameworks":["CIS","ISO27001","SOC2"],"required_actions":["..."],"needs_human_signoff":true|false,"evidence":["finding_id:原因"]}。规则：互联网暴露+敏感数据+新开放高危端口才Critical；证据不足severity降一级且needs_human_signoff=true。
INPUT={{previous_snapshot,current_snapshot,diff,asset_context}}

{"previous":[{"finding_id":"sg-001-open-22","severity":"High","resource_id":"sg-0demo1","status":"ACTIVE","updated_at":"2026-09-05T10:00:00Z"}],"current":[{"finding_id":"sg-001-open-22","severity":"Critical","resource_id":"sg-0demo1","status":"ACTIVE","updated_at":"2026-09-06T10:00:00Z"},{"finding_id":"iam-002-key-age","severity":"Medium","resource_id":"user/demo-ci","status":"ACTIVE","updated_at":"2026-09-06T10:05:00Z"}],"asset_context":{"sg-0demo1":{"owner":"payments","env":"prod","data_classification":"restricted","internet_exposed":true},"user/demo-ci":{"owner":"platform","env":"dev","data_classification":"internal","internet_exposed":false}}}

{"wait_webhook_payload":{"change_id":"chg-20260906-001","signOffApproved":true,"approver":"approver@example.test","comment":"临时放行24小时并创建修复单"},"compliance_log_entry":{"change_id":"chg-20260906-001","account":"123456789012","region":"ap-southeast-1","decision":"approved","severity":"Critical","actor":"n8n-workflow","at":"2026-09-06T10:20:00Z"}}

输入与输出示例

本站虚构示意，未调用AWS/Claude；输出数字与输入finding_id一一对应。

输入

baseline含sg-001为High；新快照把sg-001升为Critical且新增iam-002 Medium，资产上下文显示sg-0demo1属payments/prod/restricted且internet_exposed=true。

对应输出

Claude示意输出：{"change_summary":"生产支付安全组22端口暴露升级，并新增CI密钥老化","severity":"Critical","frameworks":["CIS","SOC2"],"required_actions":["限制源IP","轮换CI密钥","24小时复核"],"needs_human_signoff":true,"evidence":["sg-001-open-22:High升Critical且internet_exposed"]}；进入Wait，收到signOffApproved=true后写审计并保存新baseline。

做完检查这些

• 同一快照重复运行时哈希相同并停止，不产生Slack或邮件
• 新增或升级finding会生成added/changed且调用资产上下文
• Critical项未收到signOffApproved=true前不写合规日志
• 批准或非Critical后baseline_hash更新为current快照

容易卡住的地方

• 真实Security Hub/Config代理路径未在原文给出，不能照抄Mock路径上生产
• workflow static data在并发或重装时可能丢基线，需要外部持久化再上线
• Claude输出非严格JSON会导致分支错误，必须解析失败转人工
• 审批webhook要加鉴权与过期，否则任何回调都可能放行Critical