(config)Tweak SCP account suspension (#542)

* Tweak SCP's to allow closing accounts

Author: Brian969

reference-artifacts/SCPs/PBMMAccel-Guardrails-Part1.json

@@ -142,8 +142,7 @@
       "Sid": "SSM",
       "Effect": "Deny",
       "Action": [
-        "ssm:DeleteParameter",
-        "ssm:DeleteParameters",
+        "ssm:DeleteParam*",
         "ssm:PutParameter",
         "ssm:DeleteDocument",
         "ssm:UpdateDocument",
@@ -253,7 +252,8 @@
         "ArnNotLike": {
           "aws:PrincipalARN": [
             "arn:aws:iam::*:role/AWSCloudFormationStackSetExecutionRole",
-            "arn:aws:iam::*:role/PBMMAccel-*"
+            "arn:aws:iam::*:role/PBMMAccel-*",
+            "arn:aws:iam::*:root"
           ]
         }
       }

reference-artifacts/SCPs/PBMMAccel-Guardrails-Part2.json

@@ -11,7 +11,7 @@
         "aws-marketplace:DescribePrivateMarketplaceProducts",
         "aws-marketplace:DescribePrivateMarketplaceProfile",
         "aws-marketplace:DescribePrivateMarketplaceStatus",
-        "aws-marketplace:DisassociateProductsFromPrivateMarketplace",
+        "aws-marketplace:DisassociateProducts*",
         "aws-marketplace:ListPrivateMarketplaceProducts",
         "aws-marketplace:StartPrivateMarketplace",
         "aws-marketplace:StopPrivateMarketplace",
@@ -30,6 +30,7 @@
         "iam:ListMFADevices",
         "iam:ListVirtualMFADevices",
         "iam:ResyncMFADevice",
+        "aws-portal:*",
         "sts:GetSessionToken"
       ],
       "Resource": "*",