https://aws.amazon.com/premiumsupport/knowledge-center/monitor-security-group-changes-ec2/

"AWS CodeArtifact operates in multiple Availability Zones and stores artifact data and metadata in Amazon S3 and Amazon DynamoDB. Your encrypted data is redundantly stored across multiple facilities and multiple devices in each facility, making it highly available and highly durable." https://aws.amazon.com/codeartifact/features/ With no internet connectivity, a gateway endpoint becomes necessary to access S3.

* Create an Amazon EventBridge Rule Using an AWS CloudTrail Event Pattern:
AWS CloudTrail logs API calls made in your account, including actions performed by roles.
Create an EventBridge rule that matches CloudTrail events where the AssumeRole API call is made to assume the administrator role.
* Invoke an AWS Lambda Function:
Configure the EventBridge rule to trigger a Lambda function whenever the rule's conditions are met.
The Lambda function will handle the logic to send a notification.
* Publish a Message to an Amazon SNS Topic:
The Lambda function will publish a message to an SNS topic to notify the security team.
Subscribe the security team's email address to this SNS topic to receive real-time notifications.
Example EventBridge rule pattern:
{
"source": ["aws.cloudtrail"],
"detail-type": ["AWS API Call via CloudTrail"],
"detail": {
"eventSource": ["sts.amazonaws.com"],
"eventName": ["AssumeRole"],
"requestParameters": {
"roleArn": ["arn:aws:iam::<account-id>:role/AdministratorRole"]
}
}
}
Example Lambda function (Node.js) to publish to SNS:
const AWS = require('aws-sdk');
const sns = new AWS.SNS();
exports.handler = async (event) => {
const params = {
Message: `Administrator role assumed: ${JSON.stringify(event.detail)}`, TopicArn: 'arn:aws:sns:<region>:<account-id>:<sns-topic>'
};
await sns.publish(params).promise();
};
Reference:
Creating EventBridge Rules
Using AWS Lambda with Amazon SNS

If instead you want to automatically apply the policy to existing in-scope resources, choose Auto remediate any noncompliant resources. This option creates a web ACL in each applicable account within the AWS organization and associates the web ACL with the resources in the accounts. When you choose Auto remediate any noncompliant resources, you can also choose to remove existing web ACL associations from in-scope resources, for the web ACLs that aren't managed by another active Firewall Manager policy. If you choose this option, Firewall Manager first associates the policy's web ACL with the resources, and then removes the prior associations. If a resource has an association with another web ACL that's managed by a different active Firewall Manager policy, this choice doesn't affect that association.