SEC03-BP06: Manage access based on lifecycle
Integrate access controls with operator and application lifecycle and your centralized federation provider. For example, remove a user's access when they leave the organization or change roles.
Implementation guidance
Managing access based on lifecycle ensures that permissions are granted, modified, and revoked in alignment with changes in user roles, employment status, and application requirements. This approach helps maintain security by ensuring that access rights remain appropriate throughout the entire lifecycle of identities and resources.
Key steps for implementing this best practice:
- Define lifecycle stages:
- Map out user lifecycle stages (onboarding, role changes, offboarding)
- Identify application and service lifecycle phases
- Define access requirements for each lifecycle stage
- Document approval processes for lifecycle transitions
- Establish timelines for access provisioning and deprovisioning
- Implement automated provisioning:
- Integrate with HR systems for user lifecycle events
- Automate account creation and initial access provisioning
- Use identity providers for centralized user management
- Implement just-in-time (JIT) access provisioning
- Create templates for common access patterns
- Establish role-based access management:
- Define roles based on job functions and responsibilities
- Map users to roles based on their current position
- Implement automatic role assignment based on attributes
- Create approval workflows for role changes
- Document role definitions and associated permissions
- Implement automated deprovisioning:
- Automate access removal when users leave the organization
- Implement immediate access suspension for terminated employees
- Create processes for transferring access during role changes
- Establish retention policies for user accounts and data
- Implement automated cleanup of unused accounts
- Monitor and audit lifecycle events:
- Track all access provisioning and deprovisioning events
- Monitor for orphaned accounts and unused access
- Implement regular access reviews and certifications
- Generate reports on lifecycle management effectiveness
- Set up alerts for unusual lifecycle activities
- Handle exceptions and emergency scenarios:
- Define processes for emergency access provisioning
- Establish procedures for handling lifecycle exceptions
- Create temporary access mechanisms for contractors and vendors
- Implement break-glass procedures for critical situations
- Document and audit all exception cases
Implementation examples
Example 1: Automated user lifecycle management with AWS IAM Identity Center
Example 2: Lambda function for automated lifecycle management
Example 3: Lifecycle management workflow with AWS Step Functions
AWS services to consider
Benefits of managing access based on lifecycle
- Enhanced security: Ensures access is appropriate for current roles and employment status
- Reduced risk: Minimizes the risk of unauthorized access from former employees or changed roles
- Improved compliance: Supports regulatory requirements for access management and auditing
- Operational efficiency: Automates routine access management tasks
- Better visibility: Provides clear audit trails for access changes
- Consistent processes: Ensures standardized handling of lifecycle events
- Reduced administrative overhead: Minimizes manual intervention in access management