aws:userid
https://aws.amazon.com/blogs/security/how-to-revoke-federated-users-active-aws-sessions/
SCP
Advertising: