Using Lambda to Disable IAM Users

Problem

Picture this. You work as a cloud IT professional at a medium size company and you recently hired some AWS contractors. They do a good job, and you get permission to hire more in the future. So you do, and this goes on for some time. However, you get tired of manually removing old contractor users from your IAM groups. What’s an IT pro to do?

Solution

A good way to solve this problem would be to use a scheduled Lambda function and good tagging practices to identify old users and remove their permissions. If you tag any new contractors as role: contractor, you can use a script to identify and remove them from groups automatically using this boto3 method. We will be using the serverless framework to handle the infrastructure deployment for this lambda function. Let’s get into it.