Automation to delete unused access keys for Platform users

[davidkelliott]

User Story

As a platform user
I want my access to the platform to be disabled
when I am inactive for longer than X number of months.

User Type(s)

All GitHub users (team members and collaborators)

Value

This is to mitigate the security risk, when a user has access to AWS accounts after they leave an organisation.

Questions / Assumptions / Hypothesis

Proposal

Given that Platform users can create their own keys, inactive keys should be deleted to prevent accidental leakage or unintended use; if we're not using them regularly, then there's no compelling reason to keep them active.

Definition of done

• Approach for collaborators extended to Platform users
• Access keys / Secret access keys suspended when user has been inactive for over 30 days
• Optionally notify user that their key has been deleted
• another team member has reviewed
• tests are green

Reference

How to write good user stories

[github-actions]

This issue is stale because it has been open 90 days with no activity.

[github-actions]

This issue is stale because it has been open 90 days with no activity.

[SimonPPledger]

IAM only ? what about admin users where we wouldn't normally log on

[ep-93]

@davidkelliott we need to know the above answer. Thanks!

[ewastempel]

Reopened in mistake, this is implemented already, so closing the issue