Your question is Python Log Parsing for API Abuse. Start with the requirements on the right.
Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.
Amazon CloudTrail delivers chronological records of AWS API activity. Given a large sequence of simplified CloudTrail log lines, identify IAM principals whose activity contains a suspicious burst: at least request_limit requests to at least distinct_api_limit different APIs within window_seconds.
Implement analyze_cloudtrail_logs and return the suspicious principal names in lexicographic order. Each valid log line has this format:
timestamp principal api_name status
timestamp is an integer number of seconds, principal and api_name contain no spaces, and status is either SUCCESS or FAILURE. The status is parsed but does not affect the decision. Logs are sorted by nondecreasing timestamp. A window includes both endpoints, so a request at time t - window_seconds remains in the window at time t.
Your algorithm should process the input in one pass. Maintain separate recent activity for each principal, remove expired requests, and track distinct API names efficiently.
def analyze_cloudtrail_logs(logs, window_seconds, request_limit, distinct_api_limit):