Orca Inactive-Identity Cleanup Skill

Answers the question: "Which of our identities are dead weight, and how do we safely disable or delete them?"

Every identity that exists but is never used is pure attack surface: it can be phished, its keys can leak, and nobody notices when it starts doing things. This skill sweeps an account or business unit for inactive users, groups, and non-human identities (NHIs), ranks them by identity risk score, and walks the user through cleanup with a non-destructive path (disable) and a destructive path (delete) that is always gated behind explicit confirmation.

The core signal: every identity Orca covers carries a pre-computed activity verdict on the asset itself: LastActiveTime (when it last did anything) and IsIdentityActive (Orca's uniform 90-day activity convention, computed at scan time). This holds across all six supported providers: AWS, Azure (incl. Entra ID), GCP (incl. Google Workspace), Alibaba Cloud, OCI, and Tencent Cloud. Read the verdict off the asset first; CDR log replay is corroboration, never the primary source.

Usage

/orca-inactive-identities-cleanup 123456789012                 # one cloud account
/orca-inactive-identities-cleanup "Production"                 # a business unit
/orca-inactive-identities-cleanup 123456789012 --inactive 60d  # custom time frame (skips the question)
/orca-inactive-identities-cleanup 123456789012 --only nhis     # bucket: users | groups | nhis
/orca-inactive-identities-cleanup --tag env=prod               # scope by tag (instead of account / BU)
/orca-inactive-identities-cleanup 123456789012 --action disable  # pre-select the non-destructive path