* feat(iam): add platform permission set and org-admin assume alarm (SEC-37)
Adds an Identity Center platform group and Platform permission set
assigned to the management account, and a CloudTrail alarm on
AssumeRole of OrganizationAccountAccessRole. Scripts still assume
that role. This change is not deployed.
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
* fix(iam): skip sanctioned org-admin assumes in the alarm (SEC-37)
Count failed assumes for every principal. Do not page on a successful
assume by the Platform permission set or the two repo script sessions.
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
