AWS.SecurityLake reference

AwsLogSource

Source: src/AWS/SecurityLake/AwsLogSource.ts

A natively supported AWS log source (Route 53, VPC Flow Logs, CloudTrail, Security Hub findings, …) enabled for collection into the Security Lake data lake. Requires SecurityLake.DataLake to already be enabled in every configured Region.

AwsLogSource: Collecting AWS logs

Route 53 resolver query logs

const lake = yield* SecurityLake.DataLake("Lake", {
  configurations: [{ region: "us-west-2" }],
  metaStoreManagerRoleArn: metastoreRole.roleArn,
});
const route53 = yield* SecurityLake.AwsLogSource("Route53Logs", {
  sourceName: "ROUTE53",
  regions: lake.regions,
});

VPC Flow Logs from specific accounts

const vpcFlow = yield* SecurityLake.AwsLogSource("VpcFlow", {
  sourceName: "VPC_FLOW",
  sourceVersion: "2.0",
  regions: ["us-west-2", "us-east-1"],
  accounts: ["123456789012"],
});

CustomLogSource

Source: src/AWS/SecurityLake/CustomLogSource.ts

A custom (third-party) log source registered with Amazon Security Lake. Security Lake provisions a Glue crawler, database, and table for the source, plus an IAM role the provider assumes to write OCSF-formatted data into the data lake. Requires SecurityLake.DataLake to already be enabled in the Region.

Every configuration property is create-only — changing any of them replaces the source.

CustomLogSource: Registering a custom source

const custom = yield* SecurityLake.CustomLogSource("AppLogs", {
  sourceName: "my-app-logs",
  eventClasses: ["FILE_ACTIVITY"],
  crawlerConfiguration: { roleArn: crawlerRole.roleArn },
  providerIdentity: {
    principal: "123456789012",
    externalId: "my-app-external-id",
  },
});

DataLake

Source: src/AWS/SecurityLake/DataLake.ts

The Amazon Security Lake data lake — the account-wide singleton that onboards the account to Security Lake. Enabling it creates S3 buckets, registers them with Lake Formation, and configures the Glue metastore in every configured Region.

This is a heavyweight, account-wide resource: enabling/disabling Security Lake affects the whole account, and the S3 buckets it creates are retained after the data lake is deleted.

DataLake: Enabling Security Lake

Single-Region data lake

const lake = yield* SecurityLake.DataLake("Lake", {
  configurations: [{ region: "us-west-2" }],
  metaStoreManagerRoleArn: metastoreRole.roleArn,
});

Lifecycle management and KMS encryption

const lake = yield* SecurityLake.DataLake("Lake", {
  configurations: [
    {
      region: "us-west-2",
      encryptionConfiguration: { kmsKeyId: key.keyId },
      lifecycleConfiguration: {
        expiration: { days: "365 days" },
        transitions: [{ storageClass: "ONEZONE_IA", days: "30 days" }],
      },
    },
  ],
  metaStoreManagerRoleArn: metastoreRole.roleArn,
  tags: { team: "security" },
});

ExceptionSubscription

Source: src/AWS/SecurityLake/ExceptionSubscription.ts

The Amazon Security Lake exception notification subscription — an account-Region singleton that delivers notifications (via SNS protocols like email, SQS, or HTTPS) whenever Security Lake hits an exception it cannot resolve automatically.

ExceptionSubscription: Subscribing to exceptions

Email notifications

const exceptions = yield* SecurityLake.ExceptionSubscription("Exceptions", {
  subscriptionProtocol: "email",
  notificationEndpoint: "security-team@example.com",
});

SQS notifications with a 30-day exception TTL

const exceptions = yield* SecurityLake.ExceptionSubscription("Exceptions", {
  subscriptionProtocol: "sqs",
  notificationEndpoint: queue.queueArn,
  exceptionTimeToLive: "30 days",
});

GetDataLakeSources

Source: src/AWS/SecurityLake/GetDataLakeSources.ts

Runtime binding for securitylake:GetDataLakeSources.

Returns a snapshot of which log sources are collecting (per account and source, with COLLECTING / MISCONFIGURED / NOT_COLLECTING statuses) so a monitoring Function can verify ingestion health. Bind the account’s DataLake. Provide the implementation with Effect.provide(AWS.SecurityLake.GetDataLakeSourcesHttp).

GetDataLakeSources: Monitoring the data lake

// init
const getSources = yield* AWS.SecurityLake.GetDataLakeSources(lake);

// runtime
const { dataLakeSources } = yield* getSources();

ListDataLakeExceptions

Source: src/AWS/SecurityLake/ListDataLakeExceptions.ts

Runtime binding for securitylake:ListDataLakeExceptions.

Enumerates the Security Lake exceptions (per-Region failures with remediation hints) so a monitoring Function can surface or alert on collection problems. Bind the account’s DataLake. Provide the implementation with Effect.provide(AWS.SecurityLake.ListDataLakeExceptionsHttp).

ListDataLakeExceptions: Monitoring the data lake

// init
const listExceptions = yield* AWS.SecurityLake.ListDataLakeExceptions(lake);

// runtime
const { exceptions } = yield* listExceptions();

Subscriber

Source: src/AWS/SecurityLake/Subscriber.ts

A Security Lake subscriber — a consumer (account or service) granted access to data in the Security Lake data lake for specific log sources.

Subscriber: Creating a Subscriber

S3 data-access subscriber

const subscriber = yield* SecurityLake.Subscriber("Analytics", {
  subscriberIdentity: {
    principal: "123456789012",
    externalId: "analytics-external-id",
  },
  sources: [{ awsLogSource: { sourceName: "ROUTE53", sourceVersion: "2.0" } }],
});

Lake Formation (query) access

const subscriber = yield* SecurityLake.Subscriber("Athena", {
  subscriberName: "athena-consumer",
  subscriberDescription: "Athena query access to VPC flow logs",
  subscriberIdentity: {
    principal: "123456789012",
    externalId: "athena-external-id",
  },
  sources: [{ awsLogSource: { sourceName: "VPC_FLOW", sourceVersion: "2.0" } }],
  accessTypes: ["LAKEFORMATION"],
  tags: { team: "security" },
});

SubscriberNotification

Source: src/AWS/SecurityLake/SubscriberNotification.ts

A Security Lake subscriber notification — notifies a data-access subscriber whenever new objects land in its Security Lake bucket, either via an AWS-managed SQS queue or a custom HTTPS endpoint.

SubscriberNotification: Notifying subscribers

SQS notifications

const notification = yield* SecurityLake.SubscriberNotification("Notify", {
  subscriberId: subscriber.subscriberId,
  sqs: true,
});

HTTPS notifications with an API key

const notification = yield* SecurityLake.SubscriberNotification("Notify", {
  subscriberId: subscriber.subscriberId,
  httpsNotificationConfiguration: {
    endpoint: "https://ingest.example.com/securitylake",
    targetRoleArn: eventsRole.roleArn,
    authorizationApiKeyName: "x-api-key",
    authorizationApiKeyValue: Redacted.make("super-secret"),
  },
});