Unused AWS Region

from panther_aws_helpers import aws_rule_context

# Define a list of verboten or unused regions
# Could modify to include expected user mappings: { "123456789012": { "us-west-1", "us-east-2" } }
UNUSED_REGIONS = {"ap-east-1", "eu-west-3", "eu-central-1"}


def rule(event):
    if (
        event.get("awsRegion", "<UNKNOWN_AWS_REGION>") in UNUSED_REGIONS
        and event.get("readOnly") is False
    ):
        return True
    return False


def title(event):
    aws_username = event.deep_get("userIdentity", "sessionContext", "sessionIssuer", "userName")
    return (
        "Non-read-only API call in unused region"
        f" {event.get('awsRegion', '<UNKNOWN_AWS_REGION>')} by user {aws_username}"
    )


def alert_context(event):
    return aws_rule_context(event)