Fix ineffective SCP, silent SNS delivery failures, and Lambda edge cases

[DustyStudy]

Summary

Full accuracy / professionalism / security review. Existing lint, terraform validate and Checkov were already clean, so these are issues the tooling can't see. Verified after the changes: cfn-lint, terraform fmt/validate (all 18 modules) and Checkov (CFN 400 passed / 0 failed; TF 644 / 0) are clean, and each Lambda change was unit-tested with mocked AWS clients. Nothing was deployed to AWS.

Security / correctness

• S3 Block Public Access SCP was a no-op. It used condition keys (s3:PutAccountPublicAccessBlock:*) that S3 doesn't define (confirmed against AWS's service reference), so the deny never matched. Replaced with an unconditional deny of PutAccountPublicAccessBlock / PutBucketPublicAccessBlock in the JSON, CFN and Terraform copies.
• SNS topics couldn't receive from service principals. root-activity-alarm, bedrock-cost-guardrails and organization-trail used the AWS-managed aws/sns key, whose policy can't grant EventBridge / Budgets / Cost Anomaly Detection / CloudTrail access, so alerts would silently never arrive. Now customer-managed keys.
• Org trail confused-deputy gap. Bucket and topic policies had no aws:SourceArn; added it, plus a TLS-only deny on the trail bucket.
• Bedrock model allow-list denied inference-profile ARNs (e.g. us.anthropic.*), breaking this repo's own claude-apps-gateway. Inference-profile ARNs are now allowed; the model allow-list still applies via the underlying foundation-model ARN.
• claude-apps-gateway: CorporateCidr now rejects 0.0.0.0/0 (the description already said never to use it); documented that the latest tag default conflicts with the IMMUTABLE ECR repo.

Lambda fixes (CFN and Terraform copies kept identical)

• remediate_open_ssh_rdp: all-traffic (-1) rules produced a revoke call with FromPort/ToPort=None, failing boto3 validation and crashing.
• wiz_webhook_bridge: secrets compared as bytes (a non-ASCII path segment raised TypeError -> 500), SNS subject sanitized, base64 bodies handled.
• deactivate_stale_iam_keys: fails safe (skips the user) if the exemption-tag lookup errors.
• audit_ai_agent_iam_roles / audit_identity_center_access: handle a single-object Statement (previously skipped or crashed), flag Allow + NotAction on Resource: "*", and stop swallowing API errors (an AccessDenied looked like "no findings").
• remediate_sagemaker_notebook_exposure: reports a failed update instead of erroring out.
• enforce_bedrock_logging: detects drift in image/embedding delivery flags, not only text.

Docs / CI

• Corrected wiz-finding-bridge docs: this repo's remediators don't accept the bridge payload, so an adapter Lambda is required.
• Added caveats: SCPs don't apply to the management account, S3 PAB behaviour, root-alarm regional coverage, EC2 isolation (primary ENI only, established connections persist).
• CI: lint the Terraform-side StackSet template, compile Python, validate policy JSON, and fail if a CFN/Terraform Lambda copy drifts.

Test plan

• CI passes (new python-and-policies job included)
• Deploy root-activity-alarm to a sandbox account in us-east-1 and trigger a root event to confirm delivery through the CMK-encrypted topic (SNS/KMS behaviour follows AWS docs; not exercised end to end here)
• Optionally attach deny-disable-s3-public-access-block to a test OU and confirm put-public-access-block is denied

Not changed, for your call: deny-disable-security-services doesn't cover guardduty:UpdateDetector, which can also disable GuardDuty; adding it would block legitimate tuning.