docs: def cloudtrail_policy(original, bucket_name, account_id, bucket_region):
      '''add CloudTrail permissions to an S3 policy, preserving existing'''
      ct_actions = [
          {
              'Action': 's3:GetBucketAcl',
              'Effect': 'Allow',
              'Principal': {'Service': 'cloudtrail.amazonaws.com'},
              'Resource': generate_arn(
                  service='s3', resource=bucket_name, region=bucket_region),
              'Sid': 'AWSCloudTrailAclCheck20150319',
          },
          {
              'Action': 's3:PutObject',
              'Condition': {
                  'StringEquals':
                  {'s3:x-amz-acl': 'bucket-owner-full-control'},
              },
              'Effect': 'Allow',
              'Principal': {'Service': 'cloudtrail.amazonaws.com'},
              'Resource': generate_arn(
                  service='s3', resource=bucket_name, region=bucket_region),
              'Sid': 'AWSCloudTrailWrite20150319',
          },
      ]
      # parse original policy
      if original is None:
          policy = {
              'Statement': [],
              'Version': '2012-10-17',
          }
      else:
          policy = json.loads(original['Policy'])
      original_actions = [a.get('Action') for a in policy['Statement']]
      for cta in ct_actions:
          if cta['Action'] not in original_actions:
              policy['Statement'].append(cta)
      return json.dumps(policy)