Identity Center EventBridge: automate offboarding

说明与用途

该方案通过监听 Identity Center 事件并使用 Lambda 更新访问列表，同时每日执行一次对账，自动完成离职人员的权限撤销。

问题

Offboarding users from an application’s access list lingers after they leave a group or are deleted, creating security audit findings.

结果

The recipe enables real‑time offboarding by reacting to Identity Center events and guarantees consistency with a nightly reconciliation, eliminating lingering access after group removal or user deletion.

工作流

• 1. Enable IAM Identity Center and create a test group and user.
• 2. Deploy a Serverless Framework stack with EventBridge rule targeting a Lambda function.
• 3. In the Lambda, on event receipt, call IsMemberInGroups to determine current membership of the user in the target group.
• 4. If the user is a member, ensure an entry exists in the application’s access list; if not, remove any existing entry.
• 5. Configure the EventBridge rule with retries and a failure queue.
• 6. Deploy a second Lambda scheduled nightly to list all group members, compare with the access list, and reconcile differences.
• 7. Monitor logs and metrics for event processing and reconciliation outcomes.

证据

Identity Center now sends events such as “GroupMembership Deleted” to the EventBridge default bus, in the account and Region of your Identity Center instance.

来源

The biggest pitfall: delivery is at least once and unordered, so decide based on the current state and reconcile regularly.

来源

The function then calls IsMemberInGroups to check whether the person is in the group right now and brings the access list in line with that state.

来源