> ## Documentation Index
> Fetch the complete documentation index at: https://playbook.smedleygroup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Quarterly Reviews

> The quarterly session: access and security review, documentation refresh, and vendor and dependency review.

One session a quarter, covering the work that only makes sense at a distance.

***

## Access and Security Review

* **People.** Confirm every IAM user, console login and repository account still belongs to someone who works here and still needs that level of access. Leavers are the most common gap.
* **Long lived access keys.** Review the age of any long lived access keys, particularly those held by third parties, and confirm they are being rotated.
* **Network.** Review security group rules, especially anything that has been added by hand to reach a database instance or the Windows workstation.
* **Certificates.** Check expiry dates on the certificates in ACM, and confirm which are managed in code and which were created by hand.

> [!NOTE]
>
> The MongoDB server certificate is self-signed and clients connect with validation relaxed, so an expiry does not produce an error and will never surface on its own. Transport is encrypted but not authenticated. See [Security, Risks and Technical Debt](/software/developer/estate/infra/talentidpipeline-infra-cdk/security).

***

## Documentation Refresh

* Re-read the infrastructure pages against reality and correct anything that has drifted.
* Confirm the architecture diagrams still match what is deployed, and re-export the draw\.io sources if not.
* Check that the checks on these pages still reflect what you actually do, and adjust them if they have stopped being honest.

***

## Vendor and Dependency Review

* **Third party integrations.** Review the Vivenu, HubSpot and timing provider integrations for deprecation notices, API version changes and announced breaking changes.
* **AWS service notices.** Check the Personal Health Dashboard and AWS announcements for deprecations affecting anything in the estate, including end of support dates for runtimes in use.
* **Repository hosting.** Track progress on moving off CodeCommit, which is closed to new customers and cannot be recreated if lost.
* **Framework end of life.** Check the support dates for the .NET and Angular versions in use, so upgrades are planned rather than forced.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.