feat(cloudtrail): support accounts for org trails

[uhei]

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area plugins

What this PR does / why we need it:

Support accounts for organization trails. When open parameter is 's3://bucket_name/prefix_name/AWSLogs/O-ID/' and 'S3AccountList' is not set get all events for all accounts in the organization CloudTrail bucket.

If 'S3AccountList' is configured get events for the account IDs specified in the comma separated list.

S3Interval also works for organisation trails.

Which issue(s) this PR fixes:

Fixes #423

[github-actions[bot]]

Rules files suggestions

aws_cloudtrail_rules.yaml

Comparing 0bcfbee7c596f9258aa96f263575e0e56984bf12 with latest tag cloudtrail-0.11.0

No changes detected

[leogr]

cc @Issif

[uhei]

Really good, I've just some minor suggestions. To complete the changes, could you also update the version and the changelog please

Thanks. I've changed the version. Generating the changelog seems broken for cloudtrail. Should be fixed in an own commit.

[github-actions[bot]]

Rules files suggestions

aws_cloudtrail_rules.yaml

Comparing 5fd72ec23460099835cb55d0225b35e3aff150fe with latest tag cloudtrail-0.11.0

No changes detected

[leogr]

Thanks. I've changed the version. Generating the changelog seems broken for cloudtrail. Should be fixed in an own commit.

cc @LucaGuerra @alacuku

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: leogr, uhei

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/falcosecurity/plugins/blob/master/OWNERS)~~ [leogr] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment

[poiana]

LGTM label has been added.

Git tree hash: 2a2f6f8a6981a7355c2b56c744fcba83e5458229