Strategy for Reassigning Resource Ownership Before Personnel Changes

The Challenge of Stale Ownership

Infrastructure ownership often becomes outdated when employees change roles or leave a company, leading to resources being managed by inactive or incorrect personnel. This issue frequently goes unnoticed until a security review or an approval request reaches an individual no longer responsible for the resource. The problem is not carelessness but a lack of formal processes for updating infrastructure ownership during personnel changes.

The 'Last Day' Misconception

The term 'last day' typically refers to the last day an individual was responsible for a particular resource, not necessarily their last day at the company. While HR and IT systems update titles and access, infrastructure ownership tags often remain unchanged. For example, an engineer promoted to a new role might still be listed as the owner for dozens of environments, leading to approvals for projects they no longer manage.

A Simple Solution: Query and Policy

Addressing stale ownership does not require a complete organizational restructuring. A solution involves implementing a specific database query, establishing a clear policy, and adding one step to existing personnel transition processes. This method focuses on proactively identifying when an owner has become inactive for a resource.

Identifying Inactive Owners with Queries

A key component of this strategy is a query that flags owners who have gone quiet. By cross-referencing owner tags (e.g., email addresses) with IAM user last-accessed details, organizations can identify resources whose owners have not been active for a specified period. An example query for AWS involves joining resource IDs and owner tags with the `aws_iam_user_last_accessed_details` table, filtering for activity older than 90 days. Similar methods apply to other platforms like Entra ID.