Identity Center EventBridge: automate offboarding

Description and use

The recipe automates offboarding by reacting to Identity Center events in EventBridge, updating an application’s access list via Lambda, and reconciling state nightly.

Problem

Offboarding users from an application’s access list lingers after they leave a group or are deleted, creating security audit findings.

Outcome

The recipe enables real‑time offboarding by reacting to Identity Center events and guarantees consistency with a nightly reconciliation, eliminating lingering access after group removal or user deletion.

Workflow

• 1. Enable IAM Identity Center and create a test group and user.
• 2. Deploy a Serverless Framework stack with EventBridge rule targeting a Lambda function.
• 3. In the Lambda, on event receipt, call IsMemberInGroups to determine current membership of the user in the target group.
• 4. If the user is a member, ensure an entry exists in the application’s access list; if not, remove any existing entry.
• 5. Configure the EventBridge rule with retries and a failure queue.
• 6. Deploy a second Lambda scheduled nightly to list all group members, compare with the access list, and reconcile differences.
• 7. Monitor logs and metrics for event processing and reconciliation outcomes.

Evidence

Identity Center now sends events such as “GroupMembership Deleted” to the EventBridge default bus, in the account and Region of your Identity Center instance.

Source

The biggest pitfall: delivery is at least once and unordered, so decide based on the current state and reconcile regularly.

Source

The function then calls IsMemberInGroups to check whether the person is in the group right now and brings the access list in line with that state.

Source