Skip to main content
PurpletGo
Start free trial

AWS

How to remove a departing employee's AWS access

Updated · 8 min read

AWS access is often the most damaging access a former employee can keep, and it is frequently outside single sign-on. Long-lived IAM access keys can be used from anywhere, and they do not care whether the person's email account was suspended.

The right steps depend on how people reach AWS: IAM users with their own credentials, or IAM Identity Center (or another identity provider) with temporary role credentials.

If they have an IAM user

  1. 1

    Deactivate or delete access keys

    Access keys work outside the console and are the highest-risk credential. Deactivate them first so you can confirm nothing legitimate breaks, then delete them.

  2. 2

    Remove the console password

    Delete the user's console login profile so they cannot sign in to the AWS Management Console.

  3. 3

    Remove MFA devices and other credentials

    Deactivate MFA devices, and delete signing certificates, SSH public keys, and service-specific credentials if they exist.

  4. 4

    Remove permissions

    Remove the user from IAM groups and detach managed and inline policies, or attach an explicit deny while you investigate.

  5. 5

    Delete the IAM user

    Once credentials and permissions are removed, delete the user. AWS requires attached items to be removed before deletion.

If they use IAM Identity Center or an identity provider

When people reach AWS through IAM Identity Center or federation, disabling the user in the identity source stops new sign-ins. Role sessions that were already issued stay valid until they expire, which can be hours depending on your session duration settings.

  • Disable or delete the user in your identity source.
  • For sensitive roles, revoke active sessions: the IAM console can attach a policy that denies requests from sessions issued before a chosen time.
  • Remove the user from permission set assignments and groups.

Rotate what they could reach

  • Secrets in AWS Secrets Manager or Parameter Store the person could read.
  • Database passwords and API keys used by applications they deployed.
  • Root account credentials and MFA, if the person ever had them.
  • Shared EC2 key pairs used for SSH access.

Check CloudTrail

CloudTrail records API activity by user and access key. Reviewing recent activity for high-access leavers, and confirming no API calls use their credentials after removal, is both a security check and evidence of when access ended.

How PurpletGo handles AWS offboarding

PurpletGo connects to AWS with IAM credentials you provide, on every plan. When an admin revokes access for a departing employee who has an IAM user, PurpletGo removes that user's long-lived credentials and blocks the account, and records the result in the same case.

  • Deletes the IAM user's access keys.
  • Attaches an inline deny-all policy, which blocks the user even if a credential was missed and can be removed if needed.
  • Deletes the console login profile.
  • The IAM user itself, MFA devices, IAM Identity Center users, and secrets rotation are left for you to handle, and can be tracked as checklist tasks.
Start Free TrialAWS integrationIT security offboarding

30-day free trial - no credit card required

FAQ

AWS: common questions

Should I delete an IAM user's access keys or deactivate them?

Deactivate first so you can confirm no application depends on the keys, then delete them. Deactivated keys stop working immediately and can be reactivated if something critical breaks.

Does disabling a user in IAM Identity Center end their active AWS sessions?

It stops new sign-ins, but role sessions that were already issued remain valid until they expire. For sensitive roles, revoke active sessions from the IAM console.

How can I tell whether a former employee used AWS after leaving?

Search CloudTrail for API activity by their IAM user name or access key IDs after their termination date.