AWS Root Activity Rule Dedup Tuning

[zaynahsmith-dasilva]

Background

THREAT-732

Changes

• Simplify dedup() to source IP only. With read-only events filtered
  at rule(), the previous IP:account:readOnly key was effectively
  IP:account, which still fans out one alert per touched account.
  Bulk root operations from a single IP (e.g., org-wide credential
  cleanup, but also a single-IP attacker touching N accounts) now
  collapse to one alert. Tradeoff: analysts must inspect the alert's
  event list to see full account scope.

Testing

[cursor]

PR Summary

Medium Risk
Changes when root misuse alerts fire and how they group across accounts; missed read-only-only abuse is possible, but mutating root actions remain covered at High severity.

Overview
Root Account Activity now fires only on non-read-only successful root API calls (enumeration/console reads are excluded), with updated rule copy in indexes and detection-coverage.json.

Dedup keys alerts by source IP only instead of IP + account + readOnly, so many accounts touched from one IP produce a single alert (analysts rely on the alert event list for scope). The per-event LOW/HIGH severity() hook is removed because read-only events no longer match; YAML High applies to all hits.

A unit test asserts read-only root activity (e.g. ListAccessKeys with readOnly: true) does not trigger the rule.

^{Reviewed by Cursor Bugbot for commit 746bf9b. Bugbot is set up for automated code reviews on this repo. Configure here.}