Search code examples
amazon-web-servicesamazon-iamaws-organizations

How to remove all resources created by aws federated user


I have a usecase where I had created federated user on fly and allowed access to perform actions on aws for 30 minutes. After that I will take access back from federated user but I need to delete resource created by him through an automated way.


Solution

  • To build on @Arafat Nalkhande's answer, cloud trail can keep track of what to delete, but it still leaves the question of how to trigger when to delete.

    If your duration were shorter (15 min or less), you could put a task in SQS that could delay, then fire a lambda that looked through cloud trail and execute deletions. One possible solution for 30 min scheduling would be to trigger a lambda a soon as the federated user logs in. This first lambda would create a 2nd lambda associated with scheduled event as explained here. This second lambda would need to contain the user's info, instructions for deleting all of the resources they created, and instructions to deleted the scheduled event (so it does not keep running every 30 min).

    Can you share more of the use case? If all your users are creating are s3 objects, and the amount of time did not have to be exactly 30 min, you could set up a bucket life cycle to delete after 24 hours.