Strays
Start free

AWS leaver checklist: removing access

Published , updated

When someone leaves, their laptop gets collected and their email switched off. Their AWS access is easier to miss: an access key in a CI system, a console password, a role in an account nobody remembered. Here's a checklist for the day they go.

On their last day

  1. Suspend them in your identity provider (Google Workspace, Microsoft 365, Okta). If they used AWS single sign-on, this removes that access.
  2. Find their IAM users in every AWS account: often named after them, or after the part of their email before the @.
  3. Deactivate their access keys (don't delete yet: if something breaks, you'll know what used them).
  4. Remove console passwords and MFA devices.
  5. Check roles with their name in the trust policy, and any vendor or personal accounts they set up to assume roles in yours.

For an IAM user called sam, list the keys, deactivate each one, then remove the console password:

aws iam list-access-keys --user-name sam
aws iam update-access-key --user-name sam --access-key-id AKIAEXAMPLE --status Inactive
aws iam delete-login-profile --user-name sam

In the first week

  1. List what they created in the last 90 days: CloudTrail's event history shows every create call by their user. Give each resource a new owner.
  2. Find what they own: resources tagged with their name or email.
  3. Rotate shared secrets they knew: database passwords, API keys in Secrets Manager or Parameter Store, deploy keys.
  4. Delete the access keys if nothing broke, then the IAM user.

To see what they did recently in a region, including what they created:

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=sam \
  --query 'Events[].[EventTime,EventName,Resources[0].ResourceName]' --output table

Keep the record

Write down who did each step and when. Auditors and customers' questionnaires ask how leavers are handled, and "here's the record for the last three" is the best answer.

Make it automatic

The step people forget is the first one: noticing someone has left. Tie the AWS checklist to your identity provider, so suspending someone there starts the AWS clean-up the same day.