Constrain AWS AssumeRole Within Your Organization
New AWS condition key which allows you to constrain assume role action to happen only within intended organization or OU to prevent malicious insider from stealing your company data.
Sorry for the sleepy voice, I recorded this @ 3 a.m.