Repository: salesforce/aws-allowlister (language: python)

Issue:
Remove sso and sso-directory from SCPs
I ran through some tests and I can confidently say that `sso` and `sso-directory` can be safely removed from the SCPs. The reason for this is that AWS SSO is typically configured in a management account (the root of the AWS org) and even with the below SCP attached to the target account, you can still log into the target account via AWS SSO from the management account. These SCPs should generally NOT be attached to the root AWS organization account because you want to keep your CDE as segmented and as small as possible. 

Let me know your thoughts on this but via this policy you have a strong argument with a QSA that a non-compliant service account cannot be used. 


I tested with the following SCP:
```
{
	"Version": "2012-10-17",
	"Statement": {
		"Sid": "AllowList",
		"Effect": "Deny",
		"NotAction": [
			"account:*",
			"acm:*",
			"amplify:*",
			"amplifybackend:*",
			"apigateway:*",
			"application-autoscaling:*",
			"appmesh:*",
			"appstream:*",
			"appsync:*",
			"athena:*",
			"autoscaling:*",
			"aws-portal:*",
			"backup:*",
			"batch:*",
			"cassandra:*",
			"clouddirectory:*",
			"cloudformation:*",
			"cloudfront:*",
			"cloudhsm:*",
			"cloudtrail:*",
			"cloudwatch:*",
			"codebuild:*",
			"codecommit:*",
			"codedeploy:*",
			"codepipeline:*",
			"cognito-identity:*",
			"cognito-idp:*",
			"cognito-sync:*",
			"comprehend:*",
			"comprehendmedical:*",
			"config:*",
			"connect:*",
			"databrew:*",
			"dataexchange:*",
			"datasync:*",
			"directconnect:*",
			"dms:*",
			"ds:*",
			"dynamodb:*",
			"ebs:*",
			"ec2:*",
			"ecr:*",
			"ecs:*",
			"eks:*",
			"elasticache:*",
			"elasticbeanstalk:*",
			"elasticfilesystem:*",
			"elasticloadbalancing:*",
			"elasticmapreduce:*",
			"es:*",
			"events:*",
			"execute-api:*",
			"firehose:*",
			"fms:*",
			"forecast:*",
			"freertos:*",
			"fsx:*",
			"glacier:*",
			"globalaccelerator:*",
			"glue:*",
			"greengrass:*",
			"groundstation:*",
			"guardduty:*",
			"health:*",
			"iam:*",
			"inspector:*",
			"iot:*",
			"iot-device-tester:*",
			"iotdeviceadvisor:*",
			"iotevents:*",
			"iotwireless:*",
			"kafka:*",
			"kendra:*",
			"kinesis:*",
			"kinesisanalytics:*",
			"kinesisvideo:*",
			"kms:*",
			"lakeformation:*",
			"lambda:*",
			"lex:*",
			"license-manager:*",
			"logs:*",
			"macie2:*",
			"mediaconnect:*",
			"mediaconvert:*",
			"medialive:*",
			"mq:*",
			"neptune-db:*",
			"opsworks:*",
			"opsworks-cm:*",
			"organizations:*",
			"outposts:*",
			"personalize:*",
			"polly:*",
			"qldb:*",
			"quicksight:*",
			"rds:*",
			"rds-data:*",
			"rds-db:*",
			"redshift:*",
			"rekognition:*",
			"resource-groups:*",
			"robomaker:*",
			"route53:*",
			"route53domains:*",
			"s3:*",
			"sagemaker:*",
			"sdb:*",
			"secretsmanager:*",
			"securityhub:*",
			"serverlessrepo:*",
			"servicecatalog:*",
			"servicediscovery:*",
			"shield:*",
			"sms:*",
			"sms-voice:*",
			"snowball:*",
			"sns:*",
			"sqs:*",
			"ssm:*",
			"states:*",
			"storagegateway:*",
			"sts:*",
			"support:*",
			"swf:*",
			"textract:*",
			"timestream:*",
			"transcribe:*",
			"transfer:*",
			"translate:*",
			"trustedadvisor:*",
			"waf:*",
			"waf-regional:*",
			"wafv2:*",
			"workdocs:*",
			"worklink:*",
			"workspaces:*",
			"xray:*"
		],
		"Resource": "*"
	}
}
```



Discussion / hints:

Fix patch:
diff --git a/aws_allowlister/data/compliance.db b/aws_allowlister/data/compliance.db
index e65c8c5..5b327fa 100644
Binary files a/aws_allowlister/data/compliance.db and b/aws_allowlister/data/compliance.db differ
diff --git a/aws_allowlister/data/overrides.yml b/aws_allowlister/data/overrides.yml
index bd39028..91e2121 100644
--- a/aws_allowlister/data/overrides.yml
+++ b/aws_allowlister/data/overrides.yml
@@ -173,8 +173,6 @@ global_inserts:
   - route53domains
   - sts
   - support
-  - sso
-  - sso-directory
 
 # ---------------------------------------------------------------------------------------------------------------------
 # Section 4: Direct inserts, per framework


Test patch:
diff --git a/test/scrapers/test_standard_table_matches.py b/test/scrapers/test_standard_table_matches.py
index ac8763a..445af1a 100644
--- a/test/scrapers/test_standard_table_matches.py
+++ b/test/scrapers/test_standard_table_matches.py
@@ -126,8 +126,6 @@ def test_get_compliant_services(self):
             "sns",
             "sqs",
             "ssm",
-            "sso",
-            "sso-directory",
             "states",
             "storagegateway",
             "sts",