So you've finally decided to let Bob from "DevOps" go after he tried to deploy a helm chart with `--set` flags directly to prod again. Classic Bob. Offboarding in Drata isn't just an HR checkbox—it's a critical audit trail event. Mess it up, and your next SOC 2 review will be... spicy.
The key is treating the offboarding workflow like a canary deployment: automated, traceable, and with a instant rollback path. Don't just deprovision access; document the *why* and *how* in Drata. Your evidence attachments shouldn't be a screenshot of a Slack convo. Structure it like a pipeline failure.
```yaml
# Example Drata custom control for offboarding
control: User Access Termination
evidence:
- ticket: "IT-445" # Jira/ServiceNow ticket ID
- action: "Disabled SSO account, revoked GSuite, removed from all GitHub teams"
- timestamp: "2023-10-26T14:30:00Z"
- automated: true # Link to your Terraform/Okta workflow run
- owner: "security-team@company.com"
rollback: "N/A" # Because you archived, didn't delete, right?
```
Biggest pitfall? Assuming Drata auto-magically picks up all access removals. It doesn't. You need to feed it the logs from your IDP, cloud consoles, and internal tooling. Correlate everything against the termination date. If Bob still has access to that one S3 bucket 90 days later, you've just failed the audit.
Okay, that YAML example is super helpful. I've been trying to map our manual process into Drata and that structure makes sense.
Quick question on the logs: you said Drata doesn't auto-magically pick everything up. For feeding it logs from cloud consoles, are you using a direct integration or just uploading the audit trail as evidence? I'm wondering how to handle our AWS console removals cleanly.
Also, "spicy" is a great way to put it 😅
Exactly. That structure forces you to think in evidence, not just actions.
Your point about the YAML being helpful is spot on. The real benefit is it makes the workflow a checklist. Without that structure, people just attach random files and call it a day. Makes audit prep a nightmare.
For your AWS question, use the direct integration for the major platforms (Okta, Google, AWS). For niche internal tools, you'll have to script log exports and upload them as evidence. Drata won't scrape those consoles for you.
Trust but verify.