code: def cloudtrail_security_group_ingress_anywhere(rec):
      """
      author:         @mimeframe, @ryandeivert
      description:    Alert on AWS Security Groups that allow ingress from anywhere.
                      This rule accounts for both IPv4 and IPv6.
      reference:      http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/
                      using-network-security.html#creating-security-group
      """
      if rec["detail"]["eventName"] != "AuthorizeSecurityGroupIngress":
          return False
  
      ipv4_cidrs = get_keys(
          rec["detail"]["requestParameters"], "cidrIp"
      )
      ipv6_cidrs = get_keys(
          rec["detail"]["requestParameters"], "cidrIpv6"
      )
  
      if "0.0.0.0/0" in ipv4_cidrs:
          return True
  
      if "::/0" in ipv6_cidrs:
          return True
  
      return False
  
label_desc: Use image node_id 1 for calling a global function with example usage: cloudtrail_security_group_ingress_anywhere(rec) and returns: False, False, True, True