GUARDRAIL "[CIS - AWS] 1.22 Ensure access to AWSCloudShellFullAccess is restricted"
  WHEN aws_iam_role_policy_attachment OR aws_iam_user_policy_attachment OR aws_iam_policy_attachment OR aws_iam_group_policy_attachment
    REQUIRE policy_arn != "arn:aws:iam::aws:policy/AWSCloudShellFullAccess"
  WHEN aws_iam_role
    REQUIRE EVERY managed_policy_arns != "arn:aws:iam::aws:policy/AWSCloudShellFullAccess"
  OVERRIDE WITH APPROVAL @security