code: def unencrypted_ami_volume(rec):
      """
      author:       airbnb_csirt
      description:  Identifies creation of an AMI with a non encrypted volume
      reference:    https://amzn.to/2rQilUn
      playbook:     (a) Reach out to the user who created the volume
                    (b) Re-create the AMI with encryption enabled
                    (c) Delete the old AMI
      """
      if rec["detail"]["eventName"] != "CreateImage":
          # check the event type early to avoid unnecessary performance impact
          return False
  
      if rec["detail"]["requestParameters"] is None:
          # requestParameters can be defined with a value of null
          return False
  
      req_params = rec["detail"]["requestParameters"]
      block_device_items = req_params.get("blockDeviceMapping", {}).get(
          "items", []
      )
      if not block_device_items:
          return False
  
      volume_encryption_enabled = set()
      for block_device in block_device_items:
          volume_encryption_enabled.add(
              block_device.get("ebs", {}).get("encrypted")
          )
  
      return not any(volume_encryption_enabled)
  
label_desc: Use image node_id 1 for calling a global function with example usage: unencrypted_ami_volume(rec) and returns: unknown, False, False, False