(eventSource:s3.amazonaws.com eventName:ListBuckets) (-"userIdentity.type":AssumedRole)