IAM Policy and Suspicious API Call Alerts

CloudTrail streams IAM changes and sensitive API calls (root login, access key creation, policy attach) to the agent, which flags anything suspicious and pings the security channel on WhatsApp.

Webhook + WhatsApp Groupiamcloudtrailsecurity

Conversation example

EventBridge: CloudTrail event AttachRolePolicy on role 'ci-deployer'
http_request → CloudTrail LookupEvents

IAM policy change detected. Pulling the event detail from CloudTrail...

whatsapp_web_send

IAM Policy Change — us-east-1 Action: AttachRolePolicy Role: ci-deployer Attached: arn:aws:iam::aws:policy/AdministratorAccess Actor: alex-k@lunogen.com (Console, MFA ✓) Source IP: 47.xx.xx.xx (matches Alex's known Berkeley IP) Time: 2026-04-12 14:18 UTC Risk assessment: HIGH — AdministratorAccess on a CI role is a blast-radius risk But: Alex is a trusted admin, MFA verified, known IP Posted to #security WhatsApp group with @alex-k tagged. If this was a mistake, reply 'revoke' and I'll detach the policy.

More AWS use cases

Deploy this in minutes

Create a LunoGen agent, connect AWS, and start running this workflow from WhatsApp today.

Back to AWS