Control: IAM roles that have not been used in 60 days should be removed

This control is from a mod dependency: