AWS Assume Role Added from Unknown External Account

let timeframe = 2*1h;
let RuleId = "0238";
let DedupFields = dynamic(["TimeGenerated"]);
let TrustedAccounts= dynamic([]);
AWSCloudTrail
| where ingestion_time() >= ago(timeframe)
| where EventName in ("CreateRole","UpdateAssumeRolePolicy")
| extend AssumeRoleDocument=iif(EventName == "CreateRole", parse_json(RequestParameters).assumeRolePolicyDocument, parse_json(RequestParameters).policyDocument)
| extend Statement=parse_json(tostring(AssumeRoleDocument)).Statement
| mv-expand Statement
| where Statement.Action =~ "sts:AssumeRole"
| where Statement.Effect =~ "Allow"
| mv-expand AddedAccount=Statement.Principal.AWS
| where not(isempty(AddedAccount))
| extend AddedAccount=iif(AddedAccount contains "*", "*", AddedAccount)
| extend AddedAccount=iif(AddedAccount startswith "arn:", split(AddedAccount, ":")[4], AddedAccount)
| where not(AddedAccount == UserIdentityAccountId)
| where not(AddedAccount in (TrustedAccounts))
| project-reorder AddedAccount
// Begin environment-specific filter.
// End environment-specific filter.
| extend UserAccount=tostring(split(UserIdentityArn, "/")[-1])
// Begin de-duplication logic.
| extend DedupFieldValues=pack_all()
| mv-apply e=DedupFields to typeof(string) on (
    extend DedupValue=DedupFieldValues[tostring(e)]
| order by e // Sorting is required to ensure make_list is deterministic.
| summarize DedupValues=make_list(DedupValue)
)
| extend DedupEntity=strcat_array(DedupValues, "
| ")
| project-away DedupFieldValues, DedupValues
| join kind=leftanti (
    SecurityAlert
| where AlertName has RuleId and ProviderName has "ASI"
| where TimeGenerated >= ago(timeframe)
| extend DedupEntity = tostring(parse_json(tostring(parse_json(ExtendedProperties)["Custom Details"])).DedupEntity[0])
| project DedupEntity
) on DedupEntity
// End de-duplication logic.