Initial Scrivas AWS discovery deliverables

Read-only cloud discovery of the Scrivas AWS Organization (o-qfj0pvhhv7)
to inform a proposal.

- scripts/: boto3 org assessment, member-account assessment, fast discovery
- findings/: self-contained HTML dashboards, written report, summary JSON,
  and the rendered Prowler benchmark report
- docs/full_discovery_plan.md: phased full-discovery plan
- index.html: landing page linking all reports
- Pipfile/.python-version: reproducible pipenv env (Python 3.12.11)

Large raw scans (OCSF JSON, CSV, compliance/) are git-ignored.

findings/member_lazka_547868853286.json

@@ -0,0 +1,132 @@
+{
+  "generated": "2026-08-19T16:10:07.425514+00:00",
+  "account_id": "547868853286",
+  "account_name": "Lazka",
+  "access": {
+    "assumed": true,
+    "role_used": "OrganizationAccountAccessRole",
+    "assumed_arn": "arn:aws:sts::547868853286:assumed-role/OrganizationAccountAccessRole/scrivas-discovery"
+  },
+  "iam_role_trust_policies": [
+    {
+      "RoleName": "AWSServiceRoleForAwsUserNotifications",
+      "Path": "/aws-service-role/notifications.amazonaws.com/",
+      "Kind": [
+        "service"
+      ],
+      "Vendor": null,
+      "AssumeRolePolicyDocument": {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Principal": {
+              "Service": "notifications.amazonaws.com"
+            },
+            "Action": "sts:AssumeRole"
+          }
+        ]
+      }
+    },
+    {
+      "RoleName": "AWSServiceRoleForCloudTrail",
+      "Path": "/aws-service-role/cloudtrail.amazonaws.com/",
+      "Kind": [
+        "service"
+      ],
+      "Vendor": null,
+      "AssumeRolePolicyDocument": {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Principal": {
+              "Service": "cloudtrail.amazonaws.com"
+            },
+            "Action": "sts:AssumeRole"
+          }
+        ]
+      }
+    },
+    {
+      "RoleName": "AWSServiceRoleForOrganizations",
+      "Path": "/aws-service-role/organizations.amazonaws.com/",
+      "Kind": [
+        "service"
+      ],
+      "Vendor": null,
+      "AssumeRolePolicyDocument": {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Principal": {
+              "Service": "organizations.amazonaws.com"
+            },
+            "Action": "sts:AssumeRole"
+          }
+        ]
+      }
+    },
+    {
+      "RoleName": "AWSServiceRoleForSupport",
+      "Path": "/aws-service-role/support.amazonaws.com/",
+      "Kind": [
+        "service"
+      ],
+      "Vendor": null,
+      "AssumeRolePolicyDocument": {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Principal": {
+              "Service": "support.amazonaws.com"
+            },
+            "Action": "sts:AssumeRole"
+          }
+        ]
+      }
+    },
+    {
+      "RoleName": "AWSServiceRoleForTrustedAdvisor",
+      "Path": "/aws-service-role/trustedadvisor.amazonaws.com/",
+      "Kind": [
+        "service"
+      ],
+      "Vendor": null,
+      "AssumeRolePolicyDocument": {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Principal": {
+              "Service": "trustedadvisor.amazonaws.com"
+            },
+            "Action": "sts:AssumeRole"
+          }
+        ]
+      }
+    },
+    {
+      "RoleName": "OrganizationAccountAccessRole",
+      "Path": "/",
+      "Kind": [
+        "cross-account/aws"
+      ],
+      "Vendor": null,
+      "AssumeRolePolicyDocument": {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Principal": {
+              "AWS": "arn:aws:iam::716468089330:root"
+            },
+            "Action": "sts:AssumeRole"
+          }
+        ]
+      }
+    }
+  ]
+}