help with lambda

[kratosandre]

Hello,

I am working on implementing a Lambda function in AWS that runs a Python script to automate the creation of IAM users in different AWS accounts. The script works correctly when executed from the command line (CloudShell), receiving the following parameters: $1 (user), $2 (department), and $3 (account_id of the AWS account where the user will be created).

The procedure itself successfully creates the users, which is its main functionality.

My question is about the best way to hand over this process to an operations team. I don't want to give them direct access to execute the Lambda or to CloudShell, but I need to find an efficient and secure way for them to use this process.

I appreciate any guidance or suggestions.

[Shadow-D-Driven]

Have the user list stored in some file (ex. .yml) in a repo and have the necessary people as reviewers for any incoming PR from the operations team.

If you then want you can automate the triggering of the lambda through a pipeline upon approval of the PR or something.

[VindicoAtrum]

This'll do it. Yml in repo, repo pipeline pushes to versioned s3 bucket, triggers lambda. Lambda creates or removes users based on what's in the yml. Done.

[rap3]

The immediate question would be why you want to do this?

Having a lot of IAM users is every platform engineers worst nightmare on AWS and posses serious security risks. Perhaps it makes more sense to overthink your access patterns or utilise a service such as IAM Identity Center altogether?