Bring the remaining IAM users under Terraform, and rotate two access keys

[ale210]

Overview

We need the eight IAM users that devops-security/terraform does not manage to be either imported, deleted or documented, because two of them are duplicate accounts for people who already have a managed account and one has never signed in. Two access keys also need rotating, because their secret halves currently exist only inside abandoned Terraform state files.

Action Items

• Confirm the current split before changing anything. 25 IAM users exist in account 035866691871; terraform/aws-users.tf manages 17. The eight it does not are bonnie_hfla, bonnie_ops, chelseybeck, devops-iam-github-action, fangyiliu, github-action-incubator, homeuniteus-app and jack.pashayan.
• Resolve the two duplicate pairs. bonnie_hfla and bonnie_ops are the same person, and bonnie_ops has never signed in. chelseyb is managed by Terraform while chelseybeck is not, and both belong to the same person. Confirm with each person which account to keep, then delete the other.
• Decide on the two dormant human accounts fangyiliu (last password use 2025-03-31) and jack.pashayan (2025-06-13), against whatever retention rule the CoP wants. Note jack.pashayan is managed by the abandoned state s3://hlfa-incubator-terragrunt/incubator/home-unite-us/qa-tmp.tfstate, which also manages a user mugdh.chauhan that no longer exists — so that state is stale and is not evidence the account is still wanted.
• Decide on the three service accounts devops-iam-github-action, github-action-incubator and homeuniteus-app. Each is a machine identity, so import rather than delete unless the workflow it serves is also gone. homeuniteus-app belongs to the home-unite-us production stack and should be resolved alongside that migration.
• Rotate homeuniteus-app's access key AKIAQQWOSJEPQUU5JRWS. It is Active, was created 2024-10-16 and was last used on 2026-07-30 against cognito-idp, so it is live. Its secret half is stored in plaintext inside an abandoned Terraform state file, which is the reason to rotate rather than merely re-import.
• Rotate github-action-incubator's access keys. The account has two Active keys, the older created 2021-04-21, and the older one's secret is likewise stored in an abandoned state file. Confirm which key the CI workflows actually use before deleting either.
• Import whichever accounts survive into terraform/aws-users.tf, following the existing pattern in that file, then run terraform plan and confirm it reports no changes for them.
• After the PR merges, re-run ./scripts/aws-terraform-coverage.ps1 and confirm every surviving IAM user reports managed-by=terraform-devops-security. The tag lands only when Terraform next touches the resource, so an apply must have run.
• Note the three IAM groups will still report as unmanaged and that is correct — AWS provides no group tagging API, so they can never carry the tag. Do not attempt to fix that here.

Resources/Instructions

• AWS account 035866691871. IAM is global; the console lists it under us-east-1.
• terraform/aws-users.tf — the file to add imported users to.
• Audit IAM users #145 (closed) — "Audit IAM users," which asked for exactly this list: users not in Terraform, users who have never logged in, and users idle 180 days or more. This issue is the remediation half of that audit.
• DR: Use it or lose it policy - IAM User Accounts #65 (closed) — "DR: Use it or lose it policy - IAM User Accounts." It was closed with every action item unchecked, so no retention policy was ever written. That is why dormant accounts have accumulated, and why the retention calls above are made per account here rather than against an existing rule.
• Import leads IAM group into terraform #156 (closed) — "Import leads IAM group into terraform," a worked example of importing existing IAM into this repository.
• User names, key IDs and last-use dates were accurate on 2026-08-28 and will drift. Re-check with aws iam list-users and aws iam get-access-key-last-used.