primeharbor / aws-account-automation Goto Github PK

Note: You cannot enable an Organization trail via CloudFormation, so you must check the box in the CloudTrail console once the OrgTrail templates are deployed.

You can now, perhaps update the template to include
IsOrganizationTrail: true

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudtrail-trail.html

https://github.com/jchrisfarris/aws-account-automation/blob/67eab1d62435cd73dc752b72e821f7218dd6ec80/lambda/ExpireUsers.py#L231

Create a second cron scheduler (say runs every minute), and second lambda that removes users from blackhole group
Then this solution will only email once a day, will auto-unlock the user quickly once they make their password change, your lambda code is clearer and there is more clarity in the logs about what is happening.
Should be a marginal cost impact to run the lambda each minute, especially compared to manual unlocking.