Dev, Design & Cloud
PurpletGo + AWS
30-day free trial - no credit card required
What it does
What PurpletGo does in AWS
Remove a departing employee's IAM access keys and console login, and block the IAM user with a deny-all policy.
- Deletes the IAM user's access keys.
- Attaches an inline deny-all policy, which blocks the user even if a credential was missed and can be removed later if needed.
- Deletes the console login profile.
- Runs when an admin or HR user revokes access for the offboarding, alongside the other systems selected for that person, and the result is recorded as revoked, failed, or needs manual action, with the reason.
What you need
- An IAM access key allowed to call ListAccessKeys, DeleteAccessKey, PutUserPolicy, DeleteLoginProfile, and GetAccountSummary.
Plan
All plans
Compare plansSetup
Set up AWS in PurpletGo
- 1
Create IAM credentials with the permissions above.
- 2
In PurpletGo, open Integrations, go to Access Revocation Apps, and click Connect.
- 3
Choose AWS, enter the access key ID and secret, and confirm your password.
Good to know
- The IAM user name is taken from the part of the work email before the @, so it must match.
- The IAM user, MFA devices, IAM Identity Center users, and shared secrets are not changed; track those as checklist tasks.
Why this matters
An ex-employee with live IAM keys can access production infrastructure directly - one of the highest-severity access risks in any offboarding, and one of the easiest to overlook manually.
Doing this by hand? Read how to remove a departing employee's AWS access.
AWS FAQ
Common questions about the AWS integration
What does PurpletGo do in AWS?
Remove a departing employee's IAM access keys and console login, and block the IAM user with a deny-all policy.
Why does removing AWS access matter when someone leaves?
An ex-employee with live IAM keys can access production infrastructure directly - one of the highest-severity access risks in any offboarding, and one of the easiest to overlook manually.
Which PurpletGo plan includes the AWS integration?
All plans.
What do I need to connect AWS to PurpletGo?
An IAM access key allowed to call ListAccessKeys, DeleteAccessKey, PutUserPolicy, DeleteLoginProfile, and GetAccountSummary.
Related
Related Dev, Design & Cloud integrations
Offboard with every system accounted for
Some integrations need the Team or Enterprise plan, shown above.
30-day free trial - no credit card required