Automating new hire access on AWS

A Healthcare & Life Sciences business working with Cloud Combinator on AWS. The client is anonymised at their request.

The challenge had four focus areas, all centred on making onboarding fast, correct and accountable.

The access matrix, a spreadsheet a third-party provider maintains, is uploaded to a versioned Amazon S3 bucket. That upload triggers a loader that parses it into Amazon DynamoDB, the live source of truth for what each role should have and what each person currently has. When an operator labels a Jira ticket, Jira calls a secured Amazon API Gateway endpoint, which starts the agent on Amazon Bedrock AgentCore.

The proof of concept met its acceptance criteria. A labelled Jira ticket now sets up a standard new hire from their role end to end, the matrix reflects exactly what was granted, Slack reports the result, and Jira holds a complete record of every step.

• Automatic runs — Labelling a Jira ticket triggers a run on AWS on its own, with no manual approval step for standard, role-based joiners.
• Role-based least privilege — The agent grants only what the role's matrix entry defines. Access beyond the role is never granted automatically, and is flagged for review.
• A self-updating source of truth — Every change is written back to Jira and to the access matrix, and a current-state spreadsheet is regenerated, so the record always reflects reality.
• Governed exceptions — Beyond-role requests can be raised in plain language through Slack, but are only applied after they are approved in Jira.
• Handover — Cloud Combinator delivered the working agent, the deployment repository and setup notes, leaving a third-party provider able to run and extend it.

With Atlassian proven end to end, the same pattern extends naturally to the other tools already captured in the matrix, giving a third-party provider a foundation for fuller, role-driven onboarding as the team continues to grow.