access_review_workflow:
  1_extract:
    - Pull access data from systems
    - Generate access report
    
  2_review:
    - Manager certification
    - Risk-based prioritization
    - Decision documentation
    
  3_action:
    - Revoke unnecessary access
    - Update exceptions
    - Document decisions
    
  4_report:
    - Compliance metrics
    - Remediation tracking

# Generate credential report
aws iam generate-credential-report
aws iam get-credential-report --output text --query Content | base64 -d

# Find inactive users
aws iam list-users | jq -r '.Users[] | select(.PasswordLastUsed < "2024-01-01") | .UserName'

# List unused access keys
aws iam get-access-key-last-used --access-key-id AKIAXXXXXXXX

def generate_access_report():
    users = get_all_users()
    report = []
    
    for user in users:
        report.append({
            'user': user.email,
            'roles': user.roles,
            'last_login': user.last_login,
            'manager': user.manager,
            'review_status': 'pending'
        })
    
    return report