Alert your team in Slack about AWS users inactive over 90 days

Every week the system checks AWS accounts for users inactive over 90 days and posts a Slack alert for each one it finds.

How the work actually flows

A straight line. Runs once per one per inactive account.

Pattern: Multiple Instances without Synchronization (12)

flowchart TD trig(["weekly aws account review"]):::trigtime s0["pull list of aws accounts"]:::svc s1["check each account's last activity"]:::task s2["filter to accounts needing review"]:::task s3["flag accounts inactive over 90 days"]:::task s4[["post slack alert per account"]]:::mi trig --> s0 s0 --> s1 s1 --> s2 s2 --> s3 s3 -->|"one per one per inactive account"| s4 out[/"slack alerts for stale aws accounts"/]:::out pay{{"keep cloud access clean without manual audits"}}:::pay s4 --> out out --> pay classDef task fill:#e7f6fe,stroke:#34b8f0,color:#2c2a29 classDef svc fill:#f6f8fa,stroke:#7c8795,color:#2c2a29 classDef mi fill:#e7f6fe,stroke:#0079a8,color:#2c2a29,stroke-width:2px classDef human fill:#fff,stroke:#0079a8,color:#0079a8 classDef store fill:#f6f8fa,stroke:#0079a8,color:#2c2a29 classDef trig fill:#00a4eb,stroke:#0079a8,color:#fff,font-weight:bold classDef trigtime fill:#00a4eb,stroke:#0079a8,color:#fff,font-weight:bold classDef trigdata fill:#8ad4f5,stroke:#0079a8,color:#06314c,font-weight:bold classDef gate fill:#fff,stroke:#e8a23d,color:#6b4708,font-weight:bold classDef out fill:#1f9d6b,stroke:#167a53,color:#fff,font-weight:bold classDef pay fill:#06314c,stroke:#021f33,color:#fff
Starts itA stepAn outside serviceRuns once per itemResultPayoff
Build size
Advanced

A larger build with multiple systems, AI reasoning, and custom rules.

Business functions
Messaging & NotificationsDevOps & IT OperationsSecurity & Compliance
Connects
AWS IAMSlack

The problem it solves

Old cloud accounts that nobody uses are a security risk, but nobody has time to review every user by hand every week. Stale accounts can sit unnoticed for months until an audit or a security incident forces the question.

Who it fits

IT, security, or DevOps teams responsible for keeping cloud account access clean and audit-ready.

How it works

  1. Runs automatically every week on a set schedule
  2. Pulls the full list of cloud accounts and checks each one's last activity
  3. Filters out accounts that don't need review
  4. Flags any account inactive for more than 90 days
  5. Posts an alert in Slack for each inactive account it finds
What you get

Stale accounts caught before they become a breach

You get a weekly heads-up in Slack naming every AWS user who has gone quiet for more than 90 days.

What you get

A Slack message listing every user account that has been inactive for more than 90 days.

What you need

An AWS account with read access to user data and a Slack workspace with a bot connected.

We can build this. But should you?

The hard question is not how to build it. It is whether this is the right thing to build first.

That is what a Fractional Chief AI Officer figures out with you, before anyone writes a line of code.

Let's Talk Strategy

Related automations

Get a Slack alert when AWS access keys are over a year old

Every week, the system checks AWS access keys and posts a Slack alert for any that are over a year old.

Advanced

Enforce MFA and deactivate risky AWS access keys automatically

Every day, checks AWS users for missing MFA, disables their access keys, and alerts your team on Slack.

Standard

Scan pull requests for security vulnerabilities with AI

Every pull request gets reviewed by AI for security issues, with serious findings flagged to your team on Slack.

Advanced

Scan for security threats every 15 minutes and alert your team fast

Every 15 minutes, AI checks logs and threat feeds for risks and alerts your security team before they escalate.

Advanced
Back to the AI Playbook