Send console login alerts to on-call security before SLAs lapse

Your AWS login and role-change events arrive as JSON, causing missed suspicious activity and delayed incident response. Security teams get concise alerts so investigations start before SLAs lapse.