Before
Security or IT teams likely had to retrieve IAM users, review login dates and account ages individually, and identify dormant accounts manually. Each candidate then required a separate administrator message, response check, investigation handoff, Jira task, and deletion step.
How it works
- Retrieve all IAM users and evaluate each account’s last login, or its creation age when no login has occurred.
- Send qualifying accounts to an administrator in Slack and wait for a response; only a "yes" confirmation continues the workflow.
- Create a Jira investigation task, query CloudTrail, and delete the confirmed user from IAM.
Workflow details
- Scheduled review: A webhook-triggered run, documented for weekly, monthly, or yearly scheduling, retrieves the organization’s IAM users and prepares their account information for individual evaluation.
- Inactivity assessment: Each user is checked for a last login. Users inactive for more than 25 days, or users who have never logged in and whose accounts are more than 30 days old, continue through the review path; newer or recently active accounts require no action.
- Approval workflow: For each qualifying account, the automation sends a Slack message containing the user and activity details, then waits for an administrator’s response before taking further action.
- Investigation routing: If the administrator confirms the account is concerning by replying "yes," the workflow creates a Jira task and queries CloudTrail as part of the account investigation. Any other response ends the process without further action.
- Account cleanup: After the approved investigation path, the workflow deletes the user from AWS IAM, replacing a manually coordinated review, escalation, investigation, and deletion sequence with a consistent controlled process.
What changed
Inactive-account screening now occurs during each scheduled run, with threshold checks and approval requests handled automatically. Administrators make the approval decision in Slack, after which the Jira handoff, CloudTrail query, and IAM deletion follow automatically when the response is "yes."
Work removed
Manually pulling IAM user lists, checking login and account-age thresholds, composing approval messages, reviewing Slack replies, opening Jira tasks, querying CloudTrail, and executing individual IAM deletions.
Expected outcome
Approximately 8–12 recurring manual actions can be removed for each inactive user reviewed, with consistent coverage during every scheduled run.
