Add account lifecycle

Author: jonathanfrappier

content/well-architected-framework/docs/docs/secure-systems/identity-access-management/manage-access-lifecycle.mdx

@@ -1 +1,86 @@
-// Placeholder for Manage Access Lifecycle
+---
+page_title: Manage account access lifecycle
+description: Create a plan to manage the lifecycle of user accounts and their access permissions.
+---
+
+# Manage account access lifecycle
+
+Ensuring users and services have the appropriate access to systems and data is a
+continuous process. Managing the access lifecycle involves regularly reviewing
+and updating access permissions, as well as deprovisioning access when it is no
+longer needed. Properly managing the access lifecycle helps support a secure
+environment and reduces the risk of unauthorized access.
+
+## What is access lifecycle management
+
+Access lifecycle management is the process of managing user accounts and their
+access permissions throughout their lifecycle, from creation to deprovisioning.
+This includes onboarding new users, modifying access as roles change, and
+removing access when it is no longer needed.
+
+## Why manage access lifecycle
+
+Failing to manage identity and access for users and services can lead to
+incidents, whether malicious or accidental. For example, if a user leaves the
+organization or changes roles, and their account is not deprovisioned, they may
+still have access to systems and data they are not authorized to access.
+
+A publishing company in the 2000's let go of one of their system
+administrators, but failed to deprovision their account in an email system that
+was not centrally managed. The former employee logged in, and forwarded
+thousands of spam emails to employees, causing a significant disruption
+to their day. By properly managing accounts from creation, through
+deletion, you can avoid incidents caused by unauthorized access.
+
+By [centralizing identity
+management](/well-architected-framework/secure-systems/identity-access-management/centralize-identity-management),
+you can streamline the access lifecycle for provisioning and deprovisioning
+users. This allows you to update group membership, reset passwords, or
+deprovision accounts when they are no longer needed.
+
+When you combine centralized identity management with [dynamic
+credentials](/well-architected-framework/secure-systems/identity-access-management/use-dynamic-credentials),
+you further limit the attack surface by reducing the number of long-lived
+credentials that you need to manage.
+
+NIST SP 800-53 outlines the account management process in detail, including
+the following key activities:
+
+- Account creation and provisioning
+- Account modification and review
+- Account deprovisioning and removal
+- Access reviews and audits
+
+Following these practices helps you properly manage accounts and ensure only
+those users and services that require access to a system have access.
+
+HashiCorp resources:
+
+- [Understand static and dynamic secrets](/vault/tutorials/get-started/understand-static-dynamic-secrets)
+- [Use Vault-backed dynamic secrets in HCP Terraform](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/vault-backed)
+- [Connect to Kubernetes using Vault and Boundary](/boundary/tutorials/kubernetes-connect/kubernetes-getting-started-intro)
+- [HCP Boundary Vault credential brokering quickstart](/boundary/tutorials/credential-management/hcp-vault-cred-brokering-quickstart)
+- [SSH certificate injection with HCP Boundary and Vault](/boundary/tutorials/credential-management/hcp-certificate-injection)
+
+External resources:
+
+- [NIST SP 800-53 Security and Privacy Controls for Information Systems](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)
+
+## Next steps
+
+Following these documents in order ensures a logical progression through the key
+concepts and best practices, helping you build a strong foundation to build your
+identity and access management program.
+
+- [Define access requirements](/well-architected-framework/secure-systems/identity-access-management/define-access-requirements)
+- [Grant least privilege](/well-architected-framework/secure-systems/identity-access-management/grant-least-privilege)
+- [Create permissions and guardrails](/well-architected-framework/secure-systems/identity-access-management/create-permissions-guardrails)
+- [Centralize identity management](/well-architected-framework/secure-systems/identity-access-management/centralize-identity-management)
+- [Implement strong sign-in workflows](/well-architected-framework/secure-systems/identity-access-management/implement-strong-sign-in-workflows)
+- [Use dynamic credentials](/well-architected-framework/secure-systems/identity-access-management/use-dynamic-credentials)
+- **Manage access lifecycle (this document)**
+
+In this section of **Identity and access management** you learned why its
+important to manage the full lifecycle of user accounts and permissions.
+Identity and access management is part of the [Secure
+systems](/well-architected-framework/secure-systems) pillar.