Owners and people
The People page has three parts: monthly access reviews, the leaver report, and a table of owners with what each has open.
How owners are found
First from an owner tag on the resource (Owner, CreatedBy,
Team…), then from who created it, in CloudTrail's last 90 days. Older resources
without tags show as "Unknown": add an Owner tag to fix that. An owner shown as an
IAM user name (alex), a role session (alex (DeployRole)) or a team name
has no email, so it can't be matched to a Slack user on its own. Either put the person's email in
the Owner tag, or map the name to an email on the People
page, which fixes every resource that name owns at once.
Owner names: map a name to a person's email
On People, under Owner names, an admin maps an owner as Strays shows it to an email. Members and viewers can see the list.
- The Owners table has an Email column. Where Strays can't
work out an owner's email it says No email yet: an admin types the email there
and chooses Save. Names that are the same person (
alexandalex (DeployRole)) share one box, on the first of their rows. Owner names, below the table, says how many are still missing. - Map this name adds one by hand: the owner name exactly as the owners table shows it (capitals don't matter), and an email.
- A name matches the owner exactly, and also the part before a bracket:
alexmatchesalex (DeployRole)andAlex. A mapping wins over an email Strays found itself. - Choose Remove to undo one. Up to 500 names are kept for each organisation.
Once mapped, the email shows in the Email column on People, the owner is shown as alex → alex@acme.com on This week, their new items go to that email's Slack user (or Teams card) after the next scan, and a leaver report for that email or name also lists what any of their names own. Items already sent aren't sent again.
If the email isn't a Slack user either, the owner is still unmatched: see the fallback channel.
The owners table
Each owner, with their open items, how many are security risks and what the waste costs a month. Choose a name to see just their items in Everything found. On This week the same people are shown with where each conversation has got to.
Telling owners
After each scan, Strays can tell each owner about their new items: in Slack, as a direct message with buttons, or in a Microsoft Teams channel, as a card with a link.
When someone leaves: the leaver report
While a report is being made its page says how long it has been, checks for it every 20 seconds and opens it when it's ready. If it says This is taking longer than usual, choose Try again.
On People, under Someone's leaving, enter their IAM user name or single sign-on email and choose Make the leaver report. It looks across every connected AWS account and lists:
- what they can still get into, so you can remove it;
- what they created in the last 90 days (from CloudTrail);
- what they own, so you can hand it on without breaking anything.
The report takes a moment to make. At the top it has a way back to People, a Download button for a copy to keep, and how to print it or save it as PDF. Earlier reports stay on the People page. Members and admins can make them; viewers can open them. Strays only reads: you remove the access yourself, in AWS. Leaver reports are on the Team plan and above.
To make them without anyone having to remember, connect your Google or Microsoft directory: leaver automation. Once a leaver report exists for someone, anything they owned that is still open comes to you on This week.
Access reviews
The monthly review of who can get into your AWS accounts is explained in Monthly access reviews.