Locking a role which grants access to an AWS ARN should revoke active AWS sessions spawned using that role

[webvictim]

Somewhat debatable whether this is a bug or a feature request - we can go with bug for now (as I think it's unexpected behaviour in context) and change if needed.

Expected behavior

Locking a role which grants access to AWS ARN(s) should revoke/terminate active Teleport-initiated sessions which are using that ARN.

Current behavior

Locking a role which grants access to AWS ARN(s) only prevents future sessions from being spawned and does not revoke any active STS tokens for the ARN that Teleport has issued.

Bug details:

• Teleport version: 17.1.6