fix(aws): check statement Effect instead of policy Statement in SCP a… (#11727)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>

prowler/changelog.d/scp-allow-region-check.fixed.md

@@ -0,0 +1 @@
+`organizations_scp_check_deny_regions` no longer reports false `FAIL` for AWS Organizations that restrict regions with Allow-based SCPs; the Allow path now checks the statement `Effect` instead of an always-false comparison that made it unreachable

prowler/providers/aws/services/organizations/organizations_scp_check_deny_regions/organizations_scp_check_deny_regions.py

@@ -67,7 +67,7 @@ class organizations_scp_check_deny_regions(Check):
 
                             # Allow if Condition = {"StringEquals": {"aws:RequestedRegion": [region1, region2]}}
                             if (
-                                policy.content.get("Statement") == "Allow"
+                                statement.get("Effect") == "Allow"
                                 and "Condition" in statement
                                 and "StringEquals" in statement["Condition"]
                                 and "aws:RequestedRegion"