#88: add delete protections

[reece]

Issue #88

Description of changes:

This PR provides two protections against inadvertent deletions:

1. --delete is now required to delete users and groups. (A single flag controls both behaviors.)
2. Groups with a name beginning "AWS" will never be deleted because they likely correspond to Control Tower administrative groups.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[nandubatchu]

Hey @reece - I was not aware of this and accidentally ended up deleting all my control tower groups - is there any way to recover them?

[reece]

I was able to recreate the control tower groups by renrolling each account. Good luck. My heart dropped when I discovered that the control tower groups had been deleted, but it all worked out okay in the end.

[sonrai-doyle]

Suggested change

	log.Warn("Refusing to delete")
	log.Warn("Refusing to delete group with the prefix 'AWS'")

[thapakazi]

I was able to recreate the control tower groups by renrolling each account. Good luck. My heart dropped when I discovered that the control tower groups had been deleted, but it all worked out okay in the end.

even if those are delete, why would one need sso for control tower ?

[reece]

To use Google as the identity provider for all AWS access.

[reece]

Closing due to lack of response from code maintainers.