HIGH_PRIORITY_REGIONS = ['us-east-1', 'eu-west-1']
​
# This rule applies to S3 Server Access Logs
def rule(event):
  if event.get('bucket') not in {'my-set-of-authenticated-buckets'}:
    return False
  return 'requester' not in event
​
# This rule groups alert events by the bucket name
def dedup(event):
  return event.get('bucket')
​
# Alerts will have a title like `Unauthenticated Access to S3 Bucket my-super-secret-data`
def title(event):
  return 'Unauthenticated Access to S3 Bucket  {}'.format(event.get('bucket'))
​
# Alert context will contain the bucket name and the requester information
def alert_context(event):
  return {'bucket': event.get('bucket'), 'requester': event.get('requester')}
​
# Alert Overrides
# Generated alerts will be Critical if it is in a high priority region, Info otherwise 
def severity(event):
    if event['awsRegion'] in HIGH_PRIORITY_REGIONS:
        return 'Critical'
    else:
        return 'Low'
​
# Rules with this function defined will have generated descriptions, useful for providing more details to an Alert
def description(event): 
    return 'Unauthenticated Access to S3 Bucket {} made by {}'.format(event.get('bucket'), event.get('requester'))
​
# Reference can be used to link to relevant external links
def reference(event): 
    return 'https://docs.runpanther.io/cloud-security/overview'
​
# Runbook can be used to inform how an analyst should respond to an Alert
def runbook(event):
    return 'Investigate the requester information as well as the S3 Bucket permissions.'
​
# Destinations is functionally a dynamic destination override, useful for controlling the reporting of generated alerts
def destinations(event):
    if event['awsRegion'] in HIGH_PRIORITY_REGIONS:
        return ['PagerDuty Integration']
    # Suppress the alert
    else:
        return []