Before
Teams likely had to run recurring IAM reviews, compare last-login and account-age details, and decide which users required action. They also had to move between IAM, CloudTrail, Slack, and Jira to request approval, record the work, investigate activity, and perform deletion.
How it works
- On a schedule, retrieve IAM users and evaluate each account’s login status, last activity, and age against the configured inactivity rules.
- Send qualifying users to an administrator in Slack for an explicit approval decision; stop processing the user when approval is not received.
- For approved users, create a Jira task, investigate the account in CloudTrail, and delete the IAM user.
Workflow details
- Scheduled collection: The workflow runs on a schedule, retrieves the organization’s IAM user information, extracts the relevant account details, and evaluates each user individually.
- Inactivity screening: For every user, it checks whether the account has never been used or whether the last activity is sufficiently old, including age-based comparisons around the 30-day cleanup threshold. Users that do not meet the configured conditions are left unchanged.
- Administrative approval: When an account qualifies for review, the workflow sends a Slack message showing the user and the last recorded AWS activity, then waits for an administrator’s response. A response other than an explicit approval ends the process for that user.
- Investigation and tracking: After approval, the workflow creates a Jira task identifying the inactive user and indicating the last activity date, then performs a CloudTrail investigation of the account’s activity.
- Controlled cleanup: Once the approved review path is complete, the workflow deletes the user from IAM. This replaces an ad hoc review and handoff process with a scheduled, approval-gated cleanup sequence.
What changed
Inactive-user screening now occurs during a scheduled run, with threshold checks and per-user routing handled automatically. The human decision is limited to approving or declining the Slack request, after which approved cases are documented, investigated, and cleaned up through the defined workflow.
Work removed
Recurring manual actions removed include reviewing IAM users one by one, checking last-login and account-age thresholds, identifying dormant accounts, requesting administrator approval in Slack, creating Jira tasks, initiating CloudTrail investigations, and deleting approved inactive users.
Expected outcome
A consistent scheduled process for identifying and removing approved inactive IAM users, with administrative approval, investigation, and Jira tracking applied before deletion.
