OCI IAM Unused User Credentials Should Be Disabled

# Adjust these
TENANCY_OCID="<your-tenancy-ocid>"
COMPARTMENT_OCID="<your-iam-compartment-ocid>"  # often same as tenancy
DAYS_UNUSED=90
REGION="us-ashburn-1"  # adjust

oci iam user list \
  --compartment-id "$COMPARTMENT_OCID" \
  --all \
  --query "data[].{id:id, name:name}" \
  --output json > users.json

cutoff_date=$(date -u -d "-$DAYS_UNUSED days" +"%Y-%m-%dT%H:%M:%SZ")
now=$(date -u +"%Y-%m-%dT%H:%M:%SZ")

has_recent_activity() {
  local user_ocid="$1"
  local count

  count=$(oci audit event list \
    --compartment-id "$TENANCY_OCID" \
    --start-time "$cutoff_date" \
    --end-time "$now" \
    --query "data[?identity.principalId=='$user_ocid'] | length(@)" \
    --region "$REGION" \
    --all \
    --output json)

  # If count > 0, user has recent activity
  [ "$count" -gt 0 ]
}

jq -c '.[]' users.json | while read -r user; do
  user_id=$(echo "$user" | jq -r '.id')
  user_name=$(echo "$user" | jq -r '.name')

  # Skip already INACTIVE users
  state=$(oci iam user get --user-id "$user_id" --query "data.\"lifecycle-state\"" --output text)
  if [ "$state" = "INACTIVE" ]; then
    echo "User $user_name ($user_id) already INACTIVE, skipping"
    continue
  fi

  if has_recent_activity "$user_id"; then
    echo "User $user_name ($user_id) has activity in last $DAYS_UNUSED days, skipping"
    continue
  fi

  echo "User $user_name ($user_id) has NO activity in last $DAYS_UNUSED days – remediating"

  # 4.1 Delete API keys
  oci iam api-key list \
    --user-id "$user_id" \
    --query "data[].fingerprint" \
    --output json | jq -r '.[]' | while read -r fp; do
      echo "  Deleting API key $fp for $user_name"
      oci iam api-key delete --user-id "$user_id" --fingerprint "$fp" --force
    done

  # 4.2 Delete Auth Tokens
  oci iam auth-token list \
    --user-id "$user_id" \
    --query "data[].id" \
    --output json | jq -r '.[]' | while read -r token_id; do
      echo "  Deleting Auth Token $token_id for $user_name"
      oci iam auth-token delete --user-id "$user_id" --auth-token-id "$token_id" --force
    done

  # 4.3 (Optional) Delete SMTP credentials
  oci iam smtp-credential list \
    --user-id "$user_id" \
    --query "data[].id" \
    --output json | jq -r '.[]' | while read -r smtp_id; do
      echo "  Deleting SMTP credential $smtp_id for $user_name"
      oci iam smtp-credential delete --user-id "$user_id" --smtp-credential-id "$smtp_id" --force
    done

  # 4.4 Disable the user (console login disabled)
  echo "  Disabling user $user_name"
  oci iam user update \
    --user-id "$user_id" \
    --state INACTIVE \
    --force
done

oci iam user change-password \
  --user-id "$user_id" \
  --new-password "<TemporaryStrongPassword123!>" \
  --force-change-next-login true

Allow dynamic-group <dg-name> to manage users in tenancy
Allow dynamic-group <dg-name> to read audit-events in tenancy

import oci
from datetime import datetime, timedelta, timezone

# ==== CONFIG ====
PROFILE = "DEFAULT"         # profile in ~/.oci/config
INACTIVITY_DAYS = 90        # threshold for "unused"
DRY_RUN = True              # True: just print actions, False: perform them
DISABLE_USER = False        # True: set unused users to INACTIVE
# =================

def get_clients(profile):
    config = oci.config.from_file(profile_name=profile)
    identity_client = oci.identity.IdentityClient(config)
    audit_client = oci.audit.AuditClient(config)
    return config, identity_client, audit_client

def list_all_users(identity_client, tenancy_ocid):
    users = []
    response = oci.pagination.list_call_get_all_results(
        identity_client.list_users,
        compartment_id=tenancy_ocid
    )
    users.extend(response.data)
    return users

def user_has_recent_activity(audit_client, tenancy_ocid, user_ocid, since_dt):
    """
    Check Audit events for this user since 'since_dt'.
    If any events exist, return True.
    """
    start_time = since_dt
    end_time = datetime.now(timezone.utc)

    # Audit filter by principalId
    # Note: Some actions for a user may be performed under different principals (groups, dynamic groups),
    # but for “user credentials unused” this is usually adequate.
    try:
        events = oci.pagination.list_call_get_all_results(
            audit_client.list_events,
            compartment_id=tenancy_ocid,
            start_time=start_time,
            end_time=end_time,
            principal_id=user_ocid
        ).data
    except oci.exceptions.ServiceError as e:
        print(f"Error retrieving audit events for {user_ocid}: {e}")
        return True  # fail-safe: treat as active

    return len(events) > 0

def deactivate_api_keys(identity_client, user):
    # Get API keys
    api_keys = oci.pagination.list_call_get_all_results(
        identity_client.list_api_keys,
        user_id=user.id
    ).data

    for key in api_keys:
        print(f"  Found API key {key.key_id} for user {user.name} ({user.id})")

        if DRY_RUN:
            print("    DRY RUN: would delete API key")
        else:
            identity_client.delete_api_key(user_id=user.id, fingerprint=key.fingerprint)
            print("    Deleted API key")

def delete_auth_tokens(identity_client, user):
    tokens = oci.pagination.list_call_get_all_results(
        identity_client.list_auth_tokens,
        user_id=user.id
    ).data

    for token in tokens:
        print(f"  Found auth token {token.description} ({token.id}) for user {user.name} ({user.id})")

        if DRY_RUN:
            print("    DRY RUN: would delete auth token")
        else:
            identity_client.delete_auth_token(user_id=user.id, auth_token_id=token.id)
            print("    Deleted auth token")

def disable_user(identity_client, user):
    if user.lifecycle_state == "INACTIVE":
        print(f"  User {user.name} already INACTIVE")
        return

    if DRY_RUN:
        print(f"  DRY RUN: would set user {user.name} ({user.id}) to INACTIVE")
    else:
        update_details = oci.identity.models.UpdateUserDetails(
            lifecycle_state="INACTIVE"
        )
        identity_client.update_user(user_id=user.id, update_user_details=update_details)
        print(f"  Set user {user.name} to INACTIVE")

def main():
    config, identity_client, audit_client = get_clients(PROFILE)
    tenancy_ocid = config["tenancy"]

    since_dt = datetime.now(timezone.utc) - timedelta(days=INACTIVITY_DAYS)
    print(f"Checking for users with no activity since {since_dt.isoformat()}")

    users = list_all_users(identity_client, tenancy_ocid)
    print(f"Found {len(users)} users")

    for user in users:
        # Skip already inactive users if focusing only on active credentials
        if user.lifecycle_state != "ACTIVE":
            continue

        print(f"\nEvaluating user: {user.name} ({user.id})")

        active = user_has_recent_activity(audit_client, tenancy_ocid, user.id, since_dt)

        if active:
            print("  User has recent activity, credentials considered in use.")
            continue

        print("  No recent activity found; treating credentials as UNUSED.")

        # Disable credentials
        deactivate_api_keys(identity_client, user)
        delete_auth_tokens(identity_client, user)

        if DISABLE_USER:
            disable_user(identity_client, user)

if __name__ == "__main__":
    main()