Monthly access reviews
On the first of each month Strays lists everyone and every role that can get into each connected AWS account, and emails your admins that the review is ready. Cyber Essentials, ISO 27001, SOC 2 and most customers' security questionnaires ask for regular access reviews; a signed-off review is the evidence.
What's listed
- The account owner (root login): whether it has MFA and when it was last used.
- IAM users: console password, active access keys, MFA, administrator rights (directly or through a group) and when they last signed in or used a key.
- Roles other AWS accounts can assume: which accounts, admin rights, last used. Strays' own read-only role isn't listed. If you connected your AWS Organization, each member account also lists stacksets-exec-…: AWS created it for CloudFormation StackSets, which used it to add Strays' role. It has administrator rights, but only the StackSets service in your management account can use it, and its line says so. Keep it while you use StackSets.
People who sign in through IAM Identity Center (single sign-on) are managed in your identity provider; review them there.
Starting a review, and accounts it can't read
A review reads each connected account, so you can start one only when at least one account is connected, and it can't be signed off if no account could be read. Accounts that aren't connected yet (waiting for the role, or not working) are named in Not included in this review on the page and on the signed-off record, so nobody reads the record as covering them. While the list is being gathered the page says how long it has been waiting or running, checks by itself every 20 seconds and tells you when it's ready. It usually takes under a minute. If it says This is taking longer than usual, something on our side got stuck: choose Try again, and if that doesn't help, contact support.
Doing the review
- Open the review from People (or the email). New marks anyone added since the last review; anything unused for 90 days is flagged.
- Mark each one Keep or Remove, with a note if it helps (for example "contractor until December").
- When everyone is decided, sign the review off. Your name and the date are recorded, and the signed-off record can be printed or saved as PDF.
Strays never changes anything in AWS. Remove the access you marked in IAM; for a person who has left, a leaver report lists every step.
Only admins can start, decide and sign off reviews. Access reviews are on the Team plan and above, and during the trial.