The org_root terraform is out of date (deprecated lifecycles). It also possibly has drifted from the actual config.

Also we should try out making a cloudtrail lake that could be used for analysis of security events etc