--- title: How to reassign resource ownership before someone’s last day description: Cloud resource ownership tags often go stale after promotions, transfers, or departures because ownership changes rarely trigger the same offboarding attention... canonical: https://daily.dev/posts/how-to-reassign-resource-ownership-before-someone-s-last-day-umubjjbi6 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to reassign resource ownership before someone’s last day | daily.dev og:description: Cloud resource ownership tags often go stale after promotions, transfers, or departures because ownership changes rarely trigger the same offboarding attention... og:url: https://daily.dev/posts/how-to-reassign-resource-ownership-before-someone-s-last-day-umubjjbi6 og:image: https://api.daily.dev/og/posts/UmUBJjbi6.png og:image:alt: How to reassign resource ownership before someone’s last day og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to reassign resource ownership before someone’s last day **[The New Stack](https://daily.dev/sources/newstack)** · 7 min read · 0 upvotes · 0 comments ## Summary Cloud resource ownership tags often go stale after promotions, transfers, or departures because ownership changes rarely trigger the same offboarding attention as HR title updates. The piece proposes catching this with SQL queries joining owner tags to IAM/Entra ID/Google Workspace login activity to flag owners who've gone quiet for 90+ days, enforcing ownership as an actual role assignment (not a tag) via an OPA/Rego policy that blocks removing an Owner role without a replacement, and adding a step to transfer checklists to reassign ownership before revoking access. It notes env0's Custom Roles can run this policy check on its existing drift-check schedule. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I find cloud resources whose owner tag no longer matches an active user in AWS? Join the owner tag on EC2 instances to the aws_iam_user_last_accessed_details table by splitting the owner email to get the IAM username, then group by resource and flag any owner whose last authenticated timestamp is older than 90 days. This surfaces resources likely still tagged to someone who has moved teams or left, even though their access may still be technically valid. _Track ownership drift like this alongside other infrastructure changes on daily.dev._ ### How do I detect stale resource owners in GCP since there's no IAM last-used log like AWS or Azure? GCP's IAM layer keeps no equivalent last-used record, so the closest signal comes from the identity provider itself, typically Google Workspace's login record. Join the resource owner label to the googleworkspace_users table on primary_email and check max last_login_time, flagging anyone silent for more than 90 days as a likely stale owner. _Compare cloud-specific ownership tracking gaps like this on daily.dev when picking your platform's tooling._ ### How can I write an OPA/Rego policy that blocks removing a resource's owner without assigning a replacement? A short Rego rule in the ownership package can deny any change where count(input.resource.roles.owner) == 0, meaning a resource loses its last assigned Owner role without a replacement being set. Wired into whatever evaluates policy in a Terraform or IaC pipeline, this fails the change immediately instead of letting ownership silently lapse for months. _Keep policy-as-code guardrails like this on your radar via daily.dev when hardening infrastructure workflows._ ## Similar posts on daily.dev - [How to attach an owner to every cloud resource you find](https://daily.dev/posts/how-to-attach-an-owner-to-every-cloud-resource-you-find-rd0endeab) · The New Stack · 0 upvotes · 0 comments - [How GitHub gave every repository a durable owner](https://daily.dev/posts/how-github-gave-every-repository-a-durable-owner-a4g8vfcrg) · GitHub Blog · 0 upvotes · 0 comments - [Onboarding and Offboarding: The Decision You Didn't Know You'd Already Made](https://daily.dev/posts/onboarding-and-offboarding-the-decision-you-didn-t-know-you-d-already-made-kpbrspgav) · strongdm · 0 upvotes · 0 comments - [How to Audit Cloud Spend When You Inherit a New Environment](https://daily.dev/posts/how-to-audit-cloud-spend-when-you-inherit-a-new-environment-uuzhs6gv4) · Spacelift · 0 upvotes · 0 comments - [Automate financial governance policies using Workload Manager](https://daily.dev/posts/automate-financial-governance-policies-using-workload-manager-ifbazjcxs) · Google Cloud · 1 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#platform-engineering](https://daily.dev/tags/platform-engineering), [#iam](https://daily.dev/tags/iam), [#policy-as-code](https://daily.dev/tags/policy-as-code) [View this post on daily.dev](https://daily.dev/posts/how-to-reassign-resource-ownership-before-someone-s-last-day-umubjjbi6) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to reassign resource ownership before someone’s last day","url":"https://daily.dev/posts/how-to-reassign-resource-ownership-before-someone-s-last-day-umubjjbi6","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-reassign-resource-ownership-before-someone-s-last-day-umubjjbi6"},"datePublished":"2026-09-29T14:05:02.380Z","dateModified":"2026-09-29T14:05:31.175Z","description":"Cloud resource ownership tags often go stale after promotions, transfers, or departures because ownership changes rarely trigger the same offboarding attention...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/026be08db5b57511c379b3cb36c114b2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/026be08db5b57511c379b3cb36c114b2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The New Stack","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The New Stack","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/newstack","url":"https://daily.dev/sources/newstack"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-reassign-resource-ownership-before-someone-s-last-day-umubjjbi6","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,platform-engineering,iam,policy-as-code","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The New Stack","item":"https://daily.dev/sources/newstack"},{"@type":"ListItem","position":3,"name":"How to reassign resource ownership before someone’s last day"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-reassign-resource-ownership-before-someone-s-last-day-umubjjbi6#faq","mainEntity":[{"@type":"Question","name":"How do I find cloud resources whose owner tag no longer matches an active user in AWS?","acceptedAnswer":{"@type":"Answer","text":"Join the owner tag on EC2 instances to the aws_iam_user_last_accessed_details table by splitting the owner email to get the IAM username, then group by resource and flag any owner whose last authenticated timestamp is older than 90 days. This surfaces resources likely still tagged to someone who has moved teams or left, even though their access may still be technically valid. Track ownership drift like this alongside other infrastructure changes on daily.dev."}},{"@type":"Question","name":"How do I detect stale resource owners in GCP since there's no IAM last-used log like AWS or Azure?","acceptedAnswer":{"@type":"Answer","text":"GCP's IAM layer keeps no equivalent last-used record, so the closest signal comes from the identity provider itself, typically Google Workspace's login record. Join the resource owner label to the googleworkspace_users table on primary_email and check max last_login_time, flagging anyone silent for more than 90 days as a likely stale owner. Compare cloud-specific ownership tracking gaps like this on daily.dev when picking your platform's tooling."}},{"@type":"Question","name":"How can I write an OPA/Rego policy that blocks removing a resource's owner without assigning a replacement?","acceptedAnswer":{"@type":"Answer","text":"A short Rego rule in the ownership package can deny any change where count(input.resource.roles.owner) == 0, meaning a resource loses its last assigned Owner role without a replacement being set. Wired into whatever evaluates policy in a Terraform or IaC pipeline, this fails the change immediately instead of letting ownership silently lapse for months. Keep policy-as-code guardrails like this on your radar via daily.dev when hardening infrastructure workflows."}}]} ```