code: def cloudtrail_put_object_acl_public(rec):
      """
      author:         @mimeframe
      description:    Identifies a change to an S3 object ACL that grants access
                      to AllUsers (anyone on the internet) or AuthenticatedUsers
                      (any user with an AWS account).
      reference:      http://amzn.to/2yfRxzp
      playbook:       (a) Verify if the object should be publicly accessible
                      (b) If not, modify the object ACL
      """
      request_params = rec["detail"]["requestParameters"]
      return (
          rec["detail"]["eventName"] == "PutObjectAcl"
          and
          # note: substring is used because it can exist as:
          # "http://acs.amazonaws.com/groups/global/AllUsers" or
          # "uri=http://acs.amazonaws.com/groups/global/AllUsers"
          data_has_value_from_substring_list(
              request_params, _PUBLIC_ACLS
          )
          and request_params.get("bucketName") not in _PUBLIC_BUCKETS
      )
  
label_desc: Use image node_id 1 for calling a global function with example usage: cloudtrail_put_object_acl_public(rec) and returns: unknown