data_lakes

Creates, updates, deletes, gets or lists a data_lakes resource.

Overview

Name	data_lakes
Type	Resource
Id	aws.securitylake.data_lakes

Fields

The following fields are returned by SELECT queries:

list_data_lakes

Name	Datatype	Description
data_lakes	array	Retrieves the Security Lake configuration object.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_data_lakes	select	region	regions	Retrieves the Amazon Security Lake configuration object for the specified Amazon Web Services Regions. You can use this operation to determine whether Security Lake is enabled for a Region.
create_data_lake	insert	region, configurations, metaStoreManagerRoleArn		Initializes an Amazon Security Lake instance with the provided (or default) configuration. You can enable Security Lake in Amazon Web Services Regions with customized settings before enabling log collection in Regions. To specify particular Regions, configure these Regions using the configurations parameter. If you have already enabled Security Lake in a Region when you call this command, the command will update the Region if you provide new configuration parameters. If you have not already enabled Security Lake in the Region when you call this API, it will set up the data lake in the Region with the specified configurations. When you enable Security Lake, it starts ingesting security data after the CreateAwsLogSource call and after you create subscribers using the CreateSubscriber API. This includes ingesting security data from sources, storing data, and making data accessible to subscribers. Security Lake also enables all the existing settings and resources that it stores or maintains for your Amazon Web Services account in the current Region, including security log and event data. For more information, see the Amazon Security Lake User Guide.
register_data_lake_delegated_administrator	insert	region, accountId		Designates the Amazon Security Lake delegated administrator account for the organization. This API can only be called by the organization management account. The organization management account cannot be the delegated administrator account.
update_data_lake	update	region, configurations		You can use UpdateDataLake to specify where to store your security data, how it should be encrypted at rest and for how long. You can add a Rollup Region to consolidate data from multiple Amazon Web Services Regions, replace default encryption (SSE-S3) with Customer Manged Key, or specify transition and expiration actions through storage Lifecycle management. The UpdateDataLake API works as an "upsert" operation that performs an insert if the specified item or record does not exist, or an update if it already exists. Security Lake securely stores your data at rest using Amazon Web Services encryption solutions. For more details, see Data protection in Amazon Security Lake. For example, omitting the key encryptionConfiguration from a Region that is included in an update call that currently uses KMS will leave that Region's KMS key in place, but specifying encryptionConfiguration: {kmsKeyId: 'S3_MANAGED_KEY'} for that same Region will reset the key to S3-managed. For more details about lifecycle management and how to update retention settings for one or more Regions after enabling Security Lake, see the Amazon Security Lake User Guide.
delete_data_lake	delete	region		When you disable Amazon Security Lake from your account, Security Lake is disabled in all Amazon Web Services Regions and it stops collecting data from your sources. Also, this API automatically takes steps to remove the account from Security Lake. However, Security Lake retains all of your existing settings and the resources that it created in your Amazon Web Services account in the current Amazon Web Services Region. The DeleteDataLake operation does not delete the data that is stored in your Amazon S3 bucket, which is owned by your Amazon Web Services account. For more information, see the Amazon Security Lake User Guide.
deregister_data_lake_delegated_administrator	delete	region		Deletes the Amazon Security Lake delegated administrator account for the organization. This API can only be called by the organization management account. The organization management account cannot be the delegated administrator account.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)
regions	array	The list of Regions where Security Lake is enabled.

SELECT examples

list_data_lakes

Retrieves the Amazon Security Lake configuration object for the specified Amazon Web Services Regions. You can use this operation to determine whether Security Lake is enabled for a Region.

SELECT
data_lakes
FROM aws.securitylake.data_lakes
WHERE region = '{{ region }}' -- required
AND regions = '{{ regions }}'
;

INSERT examples

create_data_lake

Initializes an Amazon Security Lake instance with the provided (or default) configuration. You can enable Security Lake in Amazon Web Services Regions with customized settings before enabling log collection in Regions. To specify particular Regions, configure these Regions using the configurations parameter. If you have already enabled Security Lake in a Region when you call this command, the command will update the Region if you provide new configuration parameters. If you have not already enabled Security Lake in the Region when you call this API, it will set up the data lake in the Region with the specified configurations. When you enable Security Lake, it starts ingesting security data after the CreateAwsLogSource call and after you create subscribers using the CreateSubscriber API. This includes ingesting security data from sources, storing data, and making data accessible to subscribers. Security Lake also enables all the existing settings and resources that it stores or maintains for your Amazon Web Services account in the current Region, including security log and event data. For more information, see the Amazon Security Lake User Guide.

INSERT INTO aws.securitylake.data_lakes (
configurations,
metaStoreManagerRoleArn,
tags,
region
)
SELECT 
'{{ configurations }}' /* required */,
'{{ metaStoreManagerRoleArn }}' /* required */,
'{{ tags }}',
'{{ region }}'
RETURNING
data_lakes
;

register_data_lake_delegated_administrator

Designates the Amazon Security Lake delegated administrator account for the organization. This API can only be called by the organization management account. The organization management account cannot be the delegated administrator account.

INSERT INTO aws.securitylake.data_lakes (
accountId,
region
)
SELECT 
'{{ accountId }}' /* required */,
'{{ region }}'
;

Manifest

# Description fields are for documentation purposes
- name: data_lakes
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the data_lakes resource.
  - name: configurations
    value:
      - encryptionConfiguration:
          kmsKeyId: "{{ kmsKeyId }}"
        lifecycleConfiguration:
          expiration:
            days: {{ days }}
          transitions:
            - days: {{ days }}
              storageClass: "{{ storageClass }}"
        region: "{{ region }}"
        replicationConfiguration:
          regions:
            - "{{ regions }}"
          roleArn: "{{ roleArn }}"
  - name: metaStoreManagerRoleArn
    value: "{{ metaStoreManagerRoleArn }}"
  - name: tags
    value:
      - key: "{{ key }}"
        value: "{{ value }}"
  - name: accountId
    value: "{{ accountId }}"

UPDATE examples

update_data_lake

You can use UpdateDataLake to specify where to store your security data, how it should be encrypted at rest and for how long. You can add a Rollup Region to consolidate data from multiple Amazon Web Services Regions, replace default encryption (SSE-S3) with Customer Manged Key, or specify transition and expiration actions through storage Lifecycle management. The UpdateDataLake API works as an "upsert" operation that performs an insert if the specified item or record does not exist, or an update if it already exists. Security Lake securely stores your data at rest using Amazon Web Services encryption solutions. For more details, see Data protection in Amazon Security Lake. For example, omitting the key encryptionConfiguration from a Region that is included in an update call that currently uses KMS will leave that Region's KMS key in place, but specifying encryptionConfiguration: {kmsKeyId: 'S3_MANAGED_KEY'} for that same Region will reset the key to S3-managed. For more details about lifecycle management and how to update retention settings for one or more Regions after enabling Security Lake, see the Amazon Security Lake User Guide.

UPDATE aws.securitylake.data_lakes
SET 
configurations = '{{ configurations }}',
metaStoreManagerRoleArn = '{{ metaStoreManagerRoleArn }}'
WHERE 
region = '{{ region }}' --required
AND configurations = '{{ configurations }}' --required
RETURNING
data_lakes;

DELETE examples

delete_data_lake

When you disable Amazon Security Lake from your account, Security Lake is disabled in all Amazon Web Services Regions and it stops collecting data from your sources. Also, this API automatically takes steps to remove the account from Security Lake. However, Security Lake retains all of your existing settings and the resources that it created in your Amazon Web Services account in the current Amazon Web Services Region. The DeleteDataLake operation does not delete the data that is stored in your Amazon S3 bucket, which is owned by your Amazon Web Services account. For more information, see the Amazon Security Lake User Guide.

DELETE FROM aws.securitylake.data_lakes
WHERE region = '{{ region }}' --required
;

deregister_data_lake_delegated_administrator

Deletes the Amazon Security Lake delegated administrator account for the organization. This API can only be called by the organization management account. The organization management account cannot be the delegated administrator account.

DELETE FROM aws.securitylake.data_lakes
WHERE region = '{{ region }}' --required
;