Before
Security or operations staff likely had to review qualifying findings, retrieve the affected user and access-key details, and create an incident manually. They also had to notify responders, wait for a remediation decision, apply the change, update the incident, and document closure across the notification thread.
How it works
- Receive and validate qualifying stale access-key issues, then retrieve the associated user and evidence details.
- Create a tracking incident and send a notification with investigation links and explicit remediation or ignore actions for responder approval.
- Apply the selected outcome, remove the decision controls, document the action, and close the incident with a final thread update.
Workflow details
- Issue intake and validation: The workflow receives a new issue event and continues only for the defined issue types associated with active IAM access keys that have not been used in more than 90 days.
- Evidence and ownership lookup: It retrieves open or in-progress issue evidence, ordered by severity, then extracts the affected IAM user and unused access key details needed for investigation and remediation.
- Incident and notification creation: The workflow creates an incident containing the evidence for tracking and reporting, then posts a notification with issue details and direct links to the issue and affected IAM user.
- Approval-based decision: The notification is updated with actions to deactivate the access key or ignore the issue, and the workflow pauses until a responder selects one of those options. If deactivation is chosen, the identified IAM credential is set inactive; if the issue is ignored, no access-key change is made.
- Closure and audit trail: After the decision, the action buttons are removed, the selected outcome is recorded in the notification thread, the incident is closed with a comment, and the thread receives a final note confirming closure.
What changed
A qualifying finding now becomes a structured incident and actionable notification automatically. The responder makes the remediation decision from the notification, after which the workflow performs the selected access-key action, records the result, removes the available controls, and closes the incident with linked documentation.
Work removed
Reviewing qualifying findings one by one, looking up IAM user and unused-key details, creating incident tickets, copying evidence into notifications, sending remediation links, waiting for a decision outside the workflow, applying the deactivation manually, removing action controls, updating the incident, and posting closure notes.
Expected outcome
A consistent approval-based handling path for stale access-key findings, with the investigation, notification, remediation record, and incident closure completed through one workflow.
