code: def cloudtrail_put_object_acl_public_publisher_example(rec, _):
      """
      description:    Identifies a change to an S3 object ACL that grants access
                      to AllUsers (anyone on the internet) or AuthenticatedUsers
                      (any user with an AWS account).
  
      note: This is purely for example purposes in testing, and is not meant to be used as-is
      """
      if rec["detail"]["sourceIPAddress"] != "1.2.3.4":
          return (
              False  # Hack to avoid triggering for other tests events
          )
  
      request_params = rec["detail"]["requestParameters"]
      return (
          rec["detail"]["eventName"] == "PutObjectAcl"
          and
          # note: substring is used because it can exist as:
          # "http://acs.amazonaws.com/groups/global/AllUsers" or
          # "uri=http://acs.amazonaws.com/groups/global/AllUsers"
          data_has_value_from_substring_list(
              request_params, _PUBLIC_ACLS
          )
      )
  
imports: from publishers.community.generic import add_record, populate_fields
  from publishers.community.pagerduty.pagerduty_layout import ShortenTitle, as_custom_details, PrettyPrintArrays
  from publishers.community.slack.slack_layout import Summary, AttachRuleInfo, AttachFullRecord
  from rules.helpers.base import data_has_value_from_substring_list
  from streamalert.shared.rule import rule
label_desc: Use image node_id 1 for calling a global function with example usage: cloudtrail_put_object_acl_public_publisher_example(rec, _) and returns: unknown, False