Transform cloud documentation into security baselines with OpenAI and GDrive

What this template does Transforms provider documentation (URLs) into an auditable, enforceable multicloud security control baseline. It: Fetches and sanitizes HTML Uses AI to extract security requirements (strict 3-line TXT blocks) Composes enforceable controls (strict 7-line TXT blocks with true-equivalence consolidation) Builds the final baseline (TXT or JSON, see Outputs) with a Technology: header Returns a downloadable artifact via webhook and can append/create the file in Google Drive Why it’s useful Eliminates manual copy-paste and produces a consistent, portable baseline ready for review, audit, or enforcement tooling—ideal for rapidly generating or refreshing baselines across cloud providers and services. Multicloud support The workflow is multicloud by design. Provide the target cloud in the request and run the same pipeline for: AWS, Azure, GCP (out of the box) Extensible to other providers/services by adjusting prompts and routing logic How it works (high level) 1. POST /create (Basic Auth) with { cloudProvider, technology, urls } 2. Input validation → generate uuid → resolve Google Drive folder (search-or-create) 3. Download & sanitize each URL 4. AI pipeline: Extractor → Composer → Baseline Builder → (optional) Baseline Auditor 5. Append/create file in Drive and return a downloadable artifact (TXT/JSON) via webhook Request (webhook) Method: POST URL: https://<your-n8n>/webhook/create Auth: Basic Auth Headers: Content-Type: application/json Example input (Postman/CLI) json { "cloudProvider": "aws", "technology": "Amazon S3", "urls": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html", "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/S3/", "https://repost.aws/knowledge-center/secure-s3-resources" } Field reference cloudProvider (string, required) — case-insensitive. Supported: aws, azure, gcp. technology (string, required) — e.g., "Amazon S3", "Azure Storage", "Google Cloud Storage". urls (string\, required) — 1–20 http(s) URLs (official/reputable docs). Optional (Google Drive destination): gdriveTargetId (string) — Google Drive folderId used for append/create. gdrivePath (string) — Path like "DefySec/Baselines" (folders are created if missing). gdriveTargetName (string) — Folder name to find/create under root. Optional (Assistant overrides): assistantExtractorId, assistantComposerId, assistantBaselineId, assistantAuditorId (strings) Resolution precedence 1. Drive: gdriveTargetId → gdrivePath → gdriveTargetName → default folder. 2. Assistants: explicit IDs above → dynamic resolution by name (expects 1DefySecExtractor, 2DefySecControlComposer, 3DefySec Baseline Builder, 4DefySecBaselineAuditor). Validation Rejects empty urls or non-http(s) schemes; normalizes cloudProvider to aws|azure|gcp. Sanitizes fetched HTML (removes scripts/styles/headers) before AI steps. Outputs Primary: downloadable TXT file controls<technology><timestamp>.txt (via webhook). Composer outcomes: if no groups to consolidate → NOCONTROLSTOBECONSOLIDATED; if nothing valid remains → NOCONTROLSFOUND.&x20; JSON path: when the Builder stage is configured for JSON-only output (strict schema), the workflow returns a .json artifact and the Auditor validates it (see next section).&x20; Techniques used (from the built-in assistants) Provider-aware extraction with strict TXT contract (3 lines): Extractor limits itself to the declared provider/technology, outputs only Description/Reference/SecurityObjective, and applies a reflexive quality check before emitting.&x20; Normalization & strict header parsing: Composer normalizes whitespace/fences, requires the CloudProvider/Technology header, and ignores anything outside the exact 3-line block shape.&x20; True-equivalence grouping & consolidation: Composer groups only when intent, enforcement locus/mechanism, scope, and mode/setting all match—otherwise items remain distinct.&x20; 7-line enforceable control format: Composer renders each (consol