adding investigation guide tag

Author: terrancedejesus

rules/integrations/aws/privilege_escalation_iam_customer_managed_policy_attached_to_role.toml

@@ -28,7 +28,7 @@ from = "now-9m"
 index = ["filebeat-*", "logs-aws.cloudtrail-*"]
 language = "kuery"
 license = "Elastic License v2"
-name = "AWS IAM Customer-Managed Policy Attached to Role by Unusual User"
+name = "AWS IAM Customer-Managed Policy Attached to Role by Rare User"
 note = """## Triage and Analysis
 
 ### Investigating AWS IAM Customer-Managed Policy Attachment to Role by Unusual User
@@ -82,6 +82,7 @@ tags = [
     "Data Source: AWS",
     "Data Source: Amazon Web Services",
     "Data Source: AWS IAM",
+    "Resources: Investigation Guide",
     "Use Case: Identity and Access Audit",
     "Tactic: Privilege Escalation",
 ]