Add AI/ML governance rules for Bedrock and SageMaker (EU AI Act / NIST AI RMF gaps)

Is your feature request related to a problem? Please describe. Teams adopting Amazon Bedrock and SageMaker are outpacing their AI governance documentation - there's no automated way to catch configuration gaps that later surface as compliance findings under frameworks like the EU AI Act, NIST AI RMF, or ISO/IEC 42001. Enterprise GRC platforms cover this, but they're priced out of reach for smaller teams running a handful of Bedrock/SageMaker resources. ScoutSuite already does this pattern well for general cloud security (CIS benchmarks) but has no equivalent coverage for AI/ML service governance.

Describe the solution you'd like Add a set of rules (findings) covering Bedrock and SageMaker configuration gaps, evaluated the same deterministic way as existing ScoutSuite rules - no LLM involved, just condition checks against fetched config. Starting scope for a first PR:

• Bedrock model invocation logging disabled
• Bedrock Guardrails not attached to models/agents
• SageMaker endpoints without data capture / model monitoring enabled
• SageMaker notebook instances with root access or no VPC config

If a Bedrock/SageMaker facet doesn't already exist in the fetch layer, I'd add that first. Happy to open with 3-5 rules for one service and expand based on feedback, and to follow up with compliance-framework mappings (similar to the existing cis-1.2.0. json ruleset pattern) in a later PR if there's interest.

Describe alternatives you've considered Considered building this as a standalone scanner/SaaS tool, but decided against it - it would duplicate ScoutSuite's fetch/rules/dashboard architecture instead of building on it, and would fragment coverage for users who already run ScoutSuite for everything else. Contributing rules upstream seemed like the better path for both maintainability and reach.

Additional context

Is anyone already working on Bedrock/SageMaker coverage? Also open to guidance on where these should live in the dashboard - as a new service grouping, or folded into a general "AI/ML" or governance- flavored section.