Add delete_access_key policy, enhance unused_access_key policy by pragya811 · Pull Request #974 · redhat-performance/cloud-governance

pragya811 · 2026-02-25T08:07:09Z

Type of change

Note: Fill x in []

bug
enhancement
documentation
dependencies

Description

Enable unused_access_key policy in action, set dry_run to 'no'.
Change days to take action from 90 to 180

For security reasons, all pull requests need to be approved first before running any automated CI

ebattat · 2026-02-25T11:34:48Z

cloud_governance/common/utils/configs.py

 CLOUDWATCH_METRICS_AVAILABLE_DAYS = 14
 AWS_DEFAULT_GLOBAL_REGION = 'us-east-1'
-UNUSED_ACCESS_KEY_DAYS = 90
+UNUSED_ACCESS_KEY_DAYS = 180


UNUSED_ACCESS_KEY_DAYS = 90
DELETE_ACCESS_KEY_DAYS = 180

changed to 90, For delete access key policy, will raise a separate PR

ebattat · 2026-02-25T13:53:32Z

@inntran, any comment ?

inntran · 2026-02-25T22:20:30Z

I wish we could move configurations from Python files to YAML. Other than that, we can not fix all code smells at this time, so let it be.

pragya811 · 2026-03-04T09:23:25Z

Changes:

Added code changes for sending email reminders to users with inactive access keys. Between 80 - 90 days, the user will get 2 reminders to take action on the unused key. Keys > 120 days of age and inactive will be eligible for deletion as mentioned above.
Keys older than 90 days are deactivated (after any grace period) and tagged with UnusedAccessKeyNInactiveDate.
Deletion:
Default: delete only inactive keys that have this policy’s tag and have been inactive for more than 120 days.
With DELETE_INACTIVE_KEYS_WITHOUT_TAG=true: delete any inactive key older than 120 days, even without the tag.

ebattat

ADD .DS_Store to git ignore

ebattat · 2026-03-04T09:20:43Z

cloud_governance/common/clouds/aws/iam/iam_operations.py

            raise err

+    def untag_user(self, user_name: str, tag_keys: list):
+        """


why we need to untag user ?

After we delete the access keys, we will remove the tags 'UnusedAccessKey1InactiveDate', etc which we added to send email reminders.

cloud_governance/common/clouds/aws/iam/iam_operations.py

ebattat · 2026-03-04T09:31:14Z

cloud_governance/policy/aws/unused_access_key.py

+                    if should_delete:
+                        if self._dry_run == 'no':
+                            try:
+                                self._delete_inactive_access_key(user_name, access_key_label)


We should send email alert before deleting the access key

Added the part about deletion for keys aged > 120 days in the email alert reminder before deactivation.

ebattat · 2026-03-04T09:32:53Z

cloud_governance/policy/aws/unused_access_key.py

+        tag_key = f"UnusedAccessKey{access_key_label.split()[-1]}ReminderCount"
+        to_user = self.get_tag_name_from_tags(tags=tags, tag_name='User') or user_name
+        display_name = self._mail_message.get_user_ldap_details(user_name=to_user) or to_user
+        subject, body = self._mail_message.unused_access_key_reminder(


Maybe we should mention that we will delete the access key after 120 days, if no key rotation is done.

ebattat · 2026-03-04T09:42:07Z

cloud_governance/policy/aws/unused_access_key.py

+                    if reminder_val in ('1', '2'):
+                        reminder_count = int(reminder_val)
+                    if reminder_count < 2 and self._dry_run == 'no':
+                        self._send_reminder_and_update_tag(


Unused Access Key Already Participates in Alerts in send_aggregated_alerts.py, why we need to send it separately ?

send_aggregated_alerts.py sends alerts post deactivation (>90 days) based on Cleanup Days. Hence added a separate email alert to alert the user twice before UNUSED_ACCESS_KEY_REMINDER_DAYS.

pragya811 · 2026-03-09T14:27:08Z

[UPDATE 9 March 2026]:

Created new policy, delete_access_key policy thereby separating the functionality from unused_access_key policy. Keys > 120 days age will be eligible for deletion.
With DELETE_INACTIVE_KEYS_WITHOUT_TAG=true: delete any inactive key older than 120 days, even without the tag. Default set to False.
Added internal grace period calculator instead of using CleanupDays tag since one single iam user can have upto 2 keys eligible for deletion/deactivation. Grace period begins post 90 days for deactivation and post 120 days for deletion upto DAYS_TO_TAKE_ACTION. User will get email alerts during this time informing of the necessary action and steps.
Included custom email alert for unused_access_key and delete_access_key policy.

TBD:
Enable configs for unsed_access_key and delete_access_key

Enable unused_access_key policy in action

0b009cc

pragya811 self-assigned this Feb 25, 2026

pragya811 added 6 commits February 25, 2026 14:03

Resolve pkg install error

182aaa3

Resolve pkg dependency issues

e124152

Resolve pkg dependency issues

03ce378

Resolve pkg dependency issues

f847f5a

Resolve pkg dependency issues

4d348f7

Resolve pkg dependency issues

2b5df99

pragya811 requested review from ebattat and inntran February 25, 2026 10:16

ebattat reviewed Feb 25, 2026

View reviewed changes

Modify config value

ee5b3c5

pragya811 marked this pull request as draft March 2, 2026 08:04

Unused access key policy changes

a96df8a

pragya811 requested a review from ebattat March 4, 2026 09:23

ebattat reviewed Mar 4, 2026

View reviewed changes

pragya811 added 4 commits March 4, 2026 17:27

Review comments

5dd6d31

Permissions for Policy changes

00c2ca3

Add delete policy, modify unused key policy

4b659a5

Merge branch 'main' into unused-key-changes

d9987ad

Disable dry run no for unused_access_keys

71d3946

pragya811 marked this pull request as ready for review March 10, 2026 07:09

pragya811 added this to Cloud-Governance project Mar 10, 2026

github-project-automation bot moved this to In progress in Cloud-Governance project Mar 10, 2026

pragya811 changed the title ~~Enable unused_access_key policy in action~~ Add delete_access_key policy, enhance unused_access_key policy Mar 10, 2026

Unittest files

dfe482a

Conversation

pragya811 commented Feb 25, 2026

Type of change

Description

For security reasons, all pull requests need to be approved first before running any automated CI

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ebattat commented Feb 25, 2026

Uh oh!

inntran commented Feb 25, 2026

Uh oh!

pragya811 commented Mar 4, 2026

Uh oh!

ebattat left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pragya811 commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

pragya811 commented Mar 9, 2026 •

edited

Loading