Status: IN
AssumeRole, AssumeRoleWithSAML, and AssumeRoleWithWebIdentity are logged as `readOnly: true` in CloudTrail despite generating credentials; GetSessionToken and GetFederationToken are `readOnly: false`.
Source: entries/2026/03/11/IAM-latest-UserGuide-cloudtrail-integrationhtml.md