Identity Center EventBridge: automate offboarding

Описание и применение

Рецепт автоматизирует отчисление пользователей из списка доступа приложения, реагируя на события Identity Center в EventBridge и синхронизируя состояние с помощью Lambda и ночного реконсиляции.

Задача

Offboarding users from an application’s access list lingers after they leave a group or are deleted, creating security audit findings.

Результат

The recipe enables real‑time offboarding by reacting to Identity Center events and guarantees consistency with a nightly reconciliation, eliminating lingering access after group removal or user deletion.

Рабочий процесс

• 1. Enable IAM Identity Center and create a test group and user.
• 2. Deploy a Serverless Framework stack with EventBridge rule targeting a Lambda function.
• 3. In the Lambda, on event receipt, call IsMemberInGroups to determine current membership of the user in the target group.
• 4. If the user is a member, ensure an entry exists in the application’s access list; if not, remove any existing entry.
• 5. Configure the EventBridge rule with retries and a failure queue.
• 6. Deploy a second Lambda scheduled nightly to list all group members, compare with the access list, and reconcile differences.
• 7. Monitor logs and metrics for event processing and reconciliation outcomes.

Доказательства

Identity Center now sends events such as “GroupMembership Deleted” to the EventBridge default bus, in the account and Region of your Identity Center instance.

Источник

The biggest pitfall: delivery is at least once and unordered, so decide based on the current state and reconcile regularly.

Источник

The function then calls IsMemberInGroups to check whether the person is in the group right now and brings the access list in line with that state.

Источник