9. Decommissioning
9. Decommissioning
← Previous: 8. Group Synchronisation | Index | Next: 10. Audit and Evidence →
9.1 One Trigger
A leaver is handled by disabling their Entra account or removing them from the pn-host-* groups; a role change is removing one group. Nothing is ever done on a host by hand (Invariant 7). Everything below cascades from that single action.
9.2 Five Layers, Each Time-Bounded
| Layer | What is revoked | When | Mechanism |
|---|---|---|---|
| 1. Login | New Arc logins denied | Immediate | Arc evaluates the Azure role at connection time; the role comes from the group. Certificates live minutes. |
| 2. Admin | PIM eligibility gone; any active elevation ends at its TTL or is cut immediately in PIM | Immediate / ≤4h | Azure PIM |
| 3. Sessions and on-host privilege | Open SSH sessions terminated; removed from pn_operator, deploy, pn_deployer; account locked and expired | ≤5 min | pn-access (Section 8). Arc does not terminate an already-open session on role removal — this is exactly why the agent exists. |
| 4. Residue | Home archived; account removed; files in /srv/pnats re-owned to deploy | 30 days | pn-access retention step — not day 0, so mistakes are reversible and forensics remain possible |
| 5. Secrets they could have read | Rotate what an Editor could read (.env via deploy group); revoke personal DB credentials; rotate the break-glass key if they could reach Key Vault | ≤24h | Leaver checklist generated from the access-map and heartbeat data |
9.3 Defence in Depth
If the agent is down, Azure still denies new logins on its own. The residual is an open session and stale Linux group membership until the agent recovers — so a missing heartbeat is itself an alert (Section 10). Human accounts have no password and no keys (Invariant 1), so even an account a failed sweep left behind is unusable: the only way to authenticate to it is Arc, which is already denied.
9.4 Evidence, Not Trust
The heartbeat reports "accounts present vs. Entra membership" per host. From that, Sentinel produces automatically:
- the 30-day stale-account review STD-IDENT-001 requires;
- a drift alert the moment a host disagrees with Entra;
- a leaver checklist — which hosts they had, which secrets they could read, which keys to rotate — without anyone reconstructing it from memory.
This closes STD-IDENT-001's declared gap: "no stale-user pruning at the host layer".
9.5 Joiners
Symmetric: add to a group → Azure permits login → the account is provisioned on first login → the next pn-access cycle applies tier groups. No host is touched.
9.6 Host Retirement
Remove from the Terraform inventory → azcmagent disconnect → delete the Arc resource → its break-glass key leaves Key Vault → drop from the access-map. Machine-scoped role assignments cascade-delete with the Arc resource (observed on the Contabo rebuilds), which is why every per-machine grant must live in Terraform so a rebuild recreates it.
Document Navigation
| Previous | Index | Next |
|---|---|---|
| ← 8. Group Synchronisation | Table of Contents | 10. Audit and Evidence → |
End of Section 9