Global security change broke a bunch of stuff ... how to figure out what was changed

All the configuration changes made to AWS resources should be logged reliably in your CloudTrail logs. If you have many accounts, are they in one or several AWS Organizations organisations, and do they have an organisation trail configured?

If the trail is available and you know which IAM roles or other form of credentials they used to make the changes, you should be able to get a full, chronological list of changes made across all your AWS accounts by querying the CloudTrail logs with Athena. In addition to filtering by identity/principal, you can write the SQL query to exclude "eventname" (=name of the API called) values starting with Describe, Get, and List to filter out the majority of events not involving modifications.

Thanks, unfortunately no trails were on and I will surely assume that it would be from this point forward. It's just odd, as I said, even taking an image that is running right now, working with security enabled, I AMI, start a new one, and things fail.

So trying to see how to get more info on the working AMI regarding the metadata options!

Thanks again

Are there many accounts where changes were, or are suspected of having been made? There's a default trail in locally in every account and region. You can't access those trails via Athena to filter and summarise them quickly, and you have to access the trail in each region separately, but all management events over the past 90 days are stored in those trails: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/tutorial-event-history.html

There's also a default filter that eliminates read-only actions from the list, but unfortunately, combining multiple filters isn't possible with the event history browser. If you have some scripting skills, it's possible to export the events with the CLI for parsing and filtering from the JSON output with an external tool: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events-cli.html

Another place to look would be AWS Config, if you happen to have it running and recording configurations for those resources. The AWS Config console makes it easy to visualise the "before" and "after" configuration states for individual changes, but it also doesn't do much to give an overview of all the changes made.