cloudtrail trigger for user removal

Question

Im using Entra ID as my external provider,
i want to do some automations when user is added and removed.
i found i can use

```
{
  "source": ["aws.sso"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["sso.amazonaws.com", "sso-directory.amazonaws.com"],
    "eventName": ["CreateUser"]
  }
}
```
when a user is addded in entra id and syncd with aws sso.

similarly how can i trigger when a user is removed in entra id

rePost-User-0695010 · Answer

For detecting user removal from Entra ID (formerly Azure AD) that syncs to AWS SSO (now called IAM Identity Center), you can use an EventBridge rule with this pattern.

{
  "source": ["aws.sso"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["sso.amazonaws.com", "sso-directory.amazonaws.com"],
    "eventName": ["DeleteUser"]
  }
}

However, you should be aware of  important point:
         The event might have a slight delay between the user being removed in Entra ID and the deletion being reflected in AWS SSO due to sync timing.

Reference: https://docs.aws.amazon.com/eventbridge/latest/ref/events-ref-sso-directory.html

cloudtrail trigger for user removal

Add your answer

Relevant content