Hey folks, been thinking a lot about cleaning up our AWS IAM landscape lately. We had a bunch of roles from old projects and prototypes just sitting there, which always feels like a low-grade security risk. So I finally carved out some time this weekend to build a small automation for it.
The idea is straightforward: a Lambda function that triggers weekly, checks all IAM roles for when they last made a request to AWS, and disables (or optionally deletes) any that have been inactive for more than 90 days. I used CloudTrail data lake queries for the activity check, which seems more reliable than just checking the `LastUsedDate` in IAM directly for some edge cases.
It's been a fun little project that really improved my own peace of mind. The function tags the roles it's about to act on and sends a summary to a Slack channel for review, giving us a last-minute chance to intervene if something looks off. I'm curious—has anyone else tackled something similar? I'd love to compare notes on how you handle the notification step or if you've found a better data source for that last-used timestamp.
good docs save lives
This is so cool! I was literally just reading about IAM security best practices yesterday and the "least privilege" principle. Your approach of using CloudTrail data lake instead of just the LastUsedDate sounds way more thorough. I guess that catches roles used by services that might not update the standard field properly?
We're just starting to use AWS at my startup, and I've been warned about credential sprawl. A Slack notification for review before anything gets deleted is such a good safety net. Did you have any trouble setting up the integration to post to Slack, or was that pretty straightforward with a webhook?