Open Stack

Has anyone implemented a scheme to automatically destroy idle objects,
or destroy idle users?

This is a shared lab system, and I have a fair number of users who log
in, set something up, and go away and forget about it forever.

I'm looking to be able to create a user with a 'drop dead time' (for
use in e.g. training), and secondly, to be able to find idle instances
(or ideally heat stacks) and shut them down, then destroy them.

e.g. If a heat stack hasn't been 'used' in 1 week, put it to sleep. If
it hasn't been woken up in 1 more week destroy it.

Now, how to know if its been 'used'. I can do something based on
horizon logins, but that entails the user always using horizon.
I can do something in general in keystone each time a user record is
looked up. That would cover all the ways to get to my instances (since
my ssh gateway & vpn method does a keystone lookup).

Has anyone done something like this before?