DR Use it or lose it policy for IAM User Accounts

This is a record in the Decision Records on Solutions Adopted.

Issue

• DR: Use it or lose it policy - IAM User Accounts #65

Problem Statement

• We need to document what our "use it or lose it" requirements are, so that we can create further issues to get compliance across all our AWS accounts.
• Constraint stated on the issue: some accounts belong to people who log in infrequently but must keep their account regardless, so the policy has to accommodate them.

Potential Solution

Criteria raised by @brittanyms, 2025-02-14:

• Inactivity threshold — what period classifies an account as inactive (120 days? ~6 months?), and what happens to members who step away and later return.
• Project accounts — whether IAM accounts are also assigned per project, and if so, whether accounts for projects that are no longer active should be deactivated.

Feasibility Determination

• Adopted. Approved by @ale210 on 2025-03-13:

  After 6 months of inactivity, IAM users will be removed

• That one line is the whole of the approved decision; no fuller recommendation was written up on the issue.

Summary

• Adopted but not implemented. As with the password policy, the issue's final action item, "Create an issue to write code and implement policy", was never done — no implementation issue exists in devops-security, and nothing in that repo's Terraform removes or flags inactive IAM users. Checked 2026-08-24.
• Two questions the approved decision does not answer, both raised on the issue before approval and neither addressed by it:
  • The must-keep-regardless accounts named in the issue body. Removing an infrequent-but-legitimate user after 6 months contradicts that constraint.
  • Whether "removed" means the IAM user is deleted or only deactivated, and whether project-level accounts are in scope.