"userIdentity.arn":.+:assumed-role/aws:.+ (-(eventSource:ssm.amazonaws.com OR eventName:RegisterManagedInstance OR sourceIPAddress:AWS\ Internal))