access-review

name	access-review
description	Conduct periodic access reviews and certifications. Implement access governance and recertification workflows. Use when managing access compliance.
license	MIT
metadata	{"author":"devops-skills","version":"1.0"}

Access Review

Implement periodic access review processes for AWS IAM, GitHub, Okta, and other identity providers, including automated reporting, certification workflows, and unused permission detection.

When to Use

• Conducting quarterly or annual access reviews for compliance (SOC 2, HIPAA, PCI DSS, ISO 27001)
• Identifying and removing stale accounts and unused credentials
• Certifying that current access levels match job responsibilities
• Detecting excessive privileges and dormant service accounts
• Generating evidence for auditor requests on access governance

Access Review Process

access_review_workflow:
  1_scope:
    actions:
      - Define systems in scope for the review cycle
      - Identify review owners (managers, system owners)
      - Set review timeline and deadlines
      - Generate access inventory from all identity sources
    frequency:
      privileged_access: Quarterly
      standard_access: Semi-annually
      service_accounts: Quarterly
      api_keys: Monthly

  2_extract:
    actions:
      - Pull current access data from all systems
      - Correlate identities across platforms (SSO mapping)
      - Enrich with last login and activity data
      - Flag accounts for review (inactive, over-privileged, orphaned)

  3_review:
    actions:
      - Assign review items to appropriate managers
      - Manager certifies each user's access (approve/revoke/modify)
      - Risk-based prioritization (privileged users reviewed first)
      - Escalate non-responses after deadline
    decisions:
      approve: "Access is appropriate for current role"
      modify: "Access needs adjustment (reduce/change scope)"
      revoke: "Access is no longer needed"

  4_remediate:
    actions:
      - Revoke access flagged for removal
      - Modify access as directed by reviewers
      - Document exceptions with justification
      - Confirm changes with system owners
    sla:
      revocations: "Complete within 5 business days of decision"
      modifications: "Complete within 10 business days"
      exceptions: "Approved by security team, documented, time-limited"

  5_report:
    actions:
      - Generate completion metrics (% reviewed, % on time)
      - Document all decisions and actions taken
      - Archive evidence for compliance audits
      - Identify process improvements for next cycle

AWS IAM Access Review Scripts

#!/usr/bin/env bash
# aws-iam-review.sh - Comprehensive IAM access review report

OUTPUT_DIR="./access-review/$(date +%Y-%m)"
mkdir -p "$OUTPUT_DIR"

echo "=== AWS IAM Access Review ==="

# Generate credential report
aws iam generate-credential-report > /dev/null
sleep 10
aws iam get-credential-report --output text --query Content | \
  base64 -d > "$OUTPUT_DIR/credential-report.csv"

echo "--- Users Without MFA ---"
aws iam get-credential-report --output text --query Content | base64 -d | \
  awk -F, 'NR>1 && $4=="true" && $8=="false" {print $1}' | \
  tee "$OUTPUT_DIR/users-without-mfa.txt"

echo "--- Inactive Users (90+ days) ---"
THRESHOLD=$(date -d '90 days ago' +%Y-%m-%dT%H:%M:%S 2>/dev/null || date -v-90d +%Y-%m-%dT%H:%M:%S)
aws iam get-credential-report --output text --query Content | base64 -d | \
  awk -F, -v t="$THRESHOLD" 'NR>1 && $5!="N/A" && $5!="no_information" && $5<t {
    print $1","$5
  }' | tee "$OUTPUT_DIR/inactive-users.csv"

echo "--- Stale Access Keys (90+ days unused) ---"
for user in $(aws iam list-users --query 'Users[*].UserName' --output text); do
  for key_id in $(aws iam list-access-keys --user-name "$user" \
    --query  --output text); 
    last_used=$(aws iam get-access-key-last-used --access-key-id  \
      --query  --output text)
     [  =  ] || [  \<  ]; 
       
    
  
 |  

 
 user  $(aws iam list-users --query  --output text); 
  policies=$(aws iam list-attached-user-policies --user-name  \
    --query  --output text)
     | grep -qi ; 
    =$(aws iam list-groups-for-user --user-name  \
      --query  --output text)
     
  
 |  

 
 role  $(aws iam list-roles --query  --output text); 
  trust=$(aws iam get-role --role-name  \
    --query  --output json 2>/dev/null)
     | grep -q  &&   | grep -qv ; 
      | jq -c 
  
 |  

 
aws iam get-credential-report --output text --query Content |  -d | \
  awk -F,  | \
   

 

GitHub Access Review

#!/usr/bin/env bash
# github-access-review.sh - GitHub organization access audit

ORG="your-org"
OUTPUT_DIR="./access-review/github/$(date +%Y-%m)"
mkdir -p "$OUTPUT_DIR"

echo "=== GitHub Organization Access Review ==="

echo "--- Organization Members ---"
gh api orgs/$ORG/members --paginate \
  --jq '.[] | [.login, .site_admin] | @csv' \
  > "$OUTPUT_DIR/org-members.csv"

echo "--- Organization Owners ---"
gh api "orgs/$ORG/members?role=admin" --paginate \
  --jq '.[] | .login' \
  > "$OUTPUT_DIR/org-owners.txt"

echo "--- Outside Collaborators ---"
gh api orgs/$ORG/outside_collaborators --paginate \
  --jq '.[] | .login' \
  > "$OUTPUT_DIR/outside-collaborators.txt"

echo "--- Repository Access Per Repo ---"
for repo in $(gh repo list $ORG --json name -q '.[].name' --limit 500); do
  echo "Repo: $repo"
  gh api "repos/$ORG/$repo/collaborators" --paginate \
    --jq '.[] | [.login, .role_name] | @csv' \
    > "$OUTPUT_DIR/repo-$repo-access.csv" 2>/dev/null


 
 team  $(gh api orgs//teams --paginate --jq ); 
   
  gh api  --paginate \
    --jq  \
    > 


 
gh api orgs//invitations --paginate \
  --jq  \
  > 

 
 repo  $(gh repo list  --json name -q  -- 500); 
  keys=$(gh api  --jq  2>/dev/null)
   [ -n  ]; 
     
  
 > 

 
 repo  $(gh repo list  --json name -q  -- 500); 
  protection=$(gh api  2>/dev/null)
   [ $? -eq 0 ]; 
     
      | jq  \
      > 
  
      >> 
  


 

Okta Access Review

#!/usr/bin/env bash
# okta-access-review.sh - Okta user and application access audit
# Requires OKTA_DOMAIN and OKTA_API_TOKEN environment variables

OUTPUT_DIR="./access-review/okta/$(date +%Y-%m)"
mkdir -p "$OUTPUT_DIR"
BASE_URL="https://${OKTA_DOMAIN}/api/v1"

echo "=== Okta Access Review ==="

echo "--- Active Users ---"
curl -s -H "Authorization: SSWS $OKTA_API_TOKEN" \
  "$BASE_URL/users?filter=status+eq+%22ACTIVE%22&limit=200" | \
  jq -r '.[] | [.profile.email, .profile.firstName, .profile.lastName, .lastLogin, .created] | @csv' \
  > "$OUTPUT_DIR/active-users.csv"

echo "--- Suspended/Deprovisioned Users ---"
for status in SUSPENDED DEPROVISIONED; do
  curl -s -H "Authorization: SSWS $OKTA_API_TOKEN" \
    "$BASE_URL/users?filter=status+eq+%22$status%22&limit=200" | \
    jq -r '.[] | [.profile.email, .status, .statusChanged] | @csv'
done > "$OUTPUT_DIR/inactive-users.csv"

echo "--- Users Without MFA Enrolled ---"
curl -s -H "Authorization: SSWS $OKTA_API_TOKEN" \
  "$BASE_URL/users?limit=200" | \
  jq -r '.[] | .id' | while read -r uid; do
    factors=$(curl -s -H  \
       | jq )
     [  -eq 0 ]; 
      curl -s -H  \
         | jq -r 
    
   > 

 
curl -s -H  \
   | \
  jq -r  |  IFS=,  -r app_id app_name status; 
     
    curl -s -H  \
       | \
      jq -r 
   > 

 
curl -s -H  \
   | \
  jq -r  |   -r uid; 
    roles=$(curl -s -H  \
       | jq -r  2>/dev/null)
     [ -n  ]; 
      email=$(curl -s -H  \
         | jq -r )
       
    
   > 

 

Unused Permission Detection

"""
Detect unused IAM permissions using CloudTrail and IAM Access Analyzer.
Generates recommendations for right-sizing access.
"""
import boto3
import json
import time
from datetime import datetime, timedelta, timezone


def analyze_iam_usage(days_lookback=90):
    """Analyze IAM user and role activity against granted permissions."""
    iam = boto3.client("iam")

    report = {
        "generated_at": datetime.now(timezone.utc).isoformat(),
        "lookback_days": days_lookback,
        "findings": [],
    }

    users = iam.list_users()["Users"]
    for user in users:
        username = user["UserName"]

        # Get service last accessed data
        job_id = iam.generate_service_last_accessed_details(
            Arn=user["Arn"]
        )["JobId"]

        while True:
            result = iam.get_service_last_accessed_details(JobId=job_id)
            if result["JobStatus"] == "COMPLETED":
                break
            time.sleep(2)

        threshold = datetime.now(timezone.utc) - timedelta(days=days_lookback)
        unused_services = []

        for service in result["ServicesLastAccessed"]:
            last_accessed = service.get("LastAuthenticated")
            if last_accessed is None or last_accessed < threshold:
                unused_services.append({
                    "service": service["ServiceNamespace"],
                    : (last_accessed)  last_accessed  ,
                })

         unused_services:
            report[].append({
                : ,
                : username,
                : user[],
                : (unused_services),
                : unused_services[:],
                : ,
            })

     report


 ():
    
    analyzer = boto3.client()

    findings = analyzer.list_findings(
        analyzerArn=,
        ={
            : {: []},
            : {: []},
        },
    )

     [
        {
            : f[],
            : f[],
            : f.get(, {}),
            : f.get(, {}),
            : f.get(, []),
            : (f[]),
        }
         f  findings.get(, [])
    ]

Certification Workflow Automation

# GitHub Actions - Automated access review reminder and tracking
name: Quarterly Access Review
on:
  schedule:
    - cron: '0 9 1 1,4,7,10 *'  # First day of each quarter
  workflow_dispatch:

jobs:
  generate-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Generate access reports
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AUDIT_AWS_KEY }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AUDIT_AWS_SECRET }}
          OKTA_DOMAIN: ${{ secrets.OKTA_DOMAIN }}
          OKTA_API_TOKEN: ${{ secrets.OKTA_API_TOKEN }}
        run: |
          bash scripts/aws-iam-review.sh
          bash scripts/github-access-review.sh
          bash scripts/okta-access-review.sh

      - name: Create review issue
        env:
          GH_TOKEN: ${{  
         
             
              
              
             

           
         
        
           
           
           

Access Review Checklist

access_review_checklist:
  preparation:
    - [ ] Define scope (systems, user populations, review period)
    - [ ] Assign review owners for each system
    - [ ] Extract current access data from all identity sources
    - [ ] Correlate identities across platforms via SSO mapping
    - [ ] Generate review packages for each manager

  execution:
    - [ ] Managers notified with review assignments and deadline
    - [ ] Privileged access reviewed first (admin, root,  
     [ ]        
     [ ]     
     [ ]       
     [ ]     
     [ ]    

  
     [ ]       
     [ ]        
     [ ]     
     [ ]      
     [ ]     

  
     [ ]  
     [ ]   
     [ ]   
     [ ]   
     [ ]       
     [ ]      

Best Practices

• Automate access data extraction to eliminate manual data gathering and reduce errors
• Integrate access review with HR systems to automatically flag accounts for departed employees
• Use risk-based review frequency: privileged access quarterly, standard access semi-annually
• Provide managers with clear context: show last login date, permissions, and role to inform decisions
• Set firm deadlines with escalation for non-response (no certification = automatic revocation)
• Detect and eliminate orphaned accounts from contractors, former employees, and decommissioned services
• Review service accounts and API keys alongside human accounts to prevent credential sprawl
• Document all exceptions with business justification, approver, and expiration date
• Track review metrics over time: completion rates, revocation rates, time to remediate
• Archive all access review evidence for a minimum of 3 years for audit purposes