Access review reporter
A small system that collects the user list from every service the business pays for, attaches an owner to each service, runs a short review twice a year, and checks continuously for accounts belonging to people who have left. It cannot remove access, and it says so. Seven posts on the same system — one diagram at a time — with a cost breakdown and an engineering reference at the end.
- 01
An access review reporter on AWS for a few dollars a month
The whole system on one page — a collector, a matcher and a reviewer — plus the continuous leaver check that is worth more than the periodic review.
- 02
How access lists get collected
Reading user lists where an API exists, handling the roughly half that do not offer one, the credential problem that makes this awkward, and why unverified services are counted rather than omitted.
- 03
How an account gets matched to a person
Why email matching alone is not enough, the four kinds of account that match nobody, and why a shared account is a finding to record rather than a problem to resolve.
- 04
How a review round runs
Why the review is per service rather than per person, what an owner actually sees, the defaults that stop it becoming a rubber stamp, and what happens to no reply.
- 05
How leavers get caught
The weekly join that finds accounts belonging to people who have left, the offboarding checklist it produces on day one, and the single number worth watching over time.
- 06
What the access review reporter costs
About $1 a month. One Bedrock read per collection is the only line that grows; the queue, the table, the mail and the storage are rounding errors. Plus the three ways the bill could surprise you.
- 07
Engineering reference: the access review reporter architecture
Same system, drawn purely for engineers. Service names, region, Lambda inventory, IAM scopes, the schemas and the exact model id.
Frequently asked questions
- What is an access review reporter?
- A small serverless system that collects who has access to which services, matches those accounts against your current staff list, runs a periodic review with the owner of each service, and flags leavers continuously. It reports; removing access is done by a person in the service itself.
- Why not remove access automatically?
- Because the account lists it reads are incomplete and occasionally wrong, and revoking the wrong access breaks somebody’s day at best. The valuable and safe part is knowing; the removal is thirty seconds of somebody’s time once they do.
- What about services with no API?
- Most small businesses have several. Those are handled as manual entries reviewed on the same cadence, marked clearly as unverified, and the report says how much of the estate is in that category.
- Is this the same as the subscription audit bot?
- They overlap deliberately. That one finds what you pay for; this one finds who can get into it. A service that appears in one and not the other is interesting in both directions.
- What does it cost to run?
- Around a dollar a month. It polls a handful of APIs weekly. See part six.