log_sources

Creates, updates, deletes, gets or lists a log_sources resource.

Overview

Name	log_sources
Type	Resource
Id	aws.securitylake.log_sources

Fields

The following fields are returned by SELECT queries:

list_log_sources

Name	Datatype	Description
account	string	Specify the account from which you want to collect logs. (pattern: <code>^[0-9]{12}$</code>)
region	string	Specify the Regions from which you want to collect logs. (pattern: <code>^(us(-gov)?|af|ap|ca|eu|me|sa)-(central|north|(north(?:east|west))|south|south(?:east|west)|east|west)-\d+$</code>)
sources	array	Specify the sources from which you want to collect logs.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_log_sources	select	region		Retrieves the log sources.
create_custom_log_source	insert	region, configuration, sourceName		Adds a third-party custom source in Amazon Security Lake, from the Amazon Web Services Region where you want to create a custom source. Security Lake can collect logs and events from third-party custom sources. After creating the appropriate IAM role to invoke Glue crawler, use this API to add a custom source name in Security Lake. This operation creates a partition in the Amazon S3 bucket for Security Lake as the target location for log files from the custom source. In addition, this operation also creates an associated Glue table and an Glue crawler.
create_aws_log_source	insert	region, sources		Adds a natively supported Amazon Web Services service as an Amazon Security Lake source. Enables source types for member accounts in required Amazon Web Services Regions, based on the parameters you specify. You can choose any source type in any Region for either accounts that are part of a trusted organization or standalone accounts. Once you add an Amazon Web Services service as a source, Security Lake starts collecting logs and events from it. You can use this API only to enable natively supported Amazon Web Services services as a source. Use CreateCustomLogSource to enable data collection from a custom source.
delete_aws_log_source	delete	region		Removes a natively supported Amazon Web Services service as an Amazon Security Lake source. You can remove a source for one or more Regions. When you remove the source, Security Lake stops collecting data from that source in the specified Regions and accounts, and subscribers can no longer consume new data from the source. However, subscribers can still consume data that Security Lake collected from the source before removal. You can choose any source type in any Amazon Web Services Region for either accounts that are part of a trusted organization or standalone accounts.
delete_custom_log_source	delete	source_name, region	sourceVersion	Removes a custom log source from Amazon Security Lake, to stop sending data from the custom source to Security Lake.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)
source_name	string	The source name of custom log source that you want to delete.
sourceVersion	string	The source version for the third-party custom source. You can limit the custom source removal to the specified source version.

SELECT examples

list_log_sources

Retrieves the log sources.

SELECT
account,
region,
sources
FROM aws.securitylake.log_sources
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_custom_log_source

Adds a third-party custom source in Amazon Security Lake, from the Amazon Web Services Region where you want to create a custom source. Security Lake can collect logs and events from third-party custom sources. After creating the appropriate IAM role to invoke Glue crawler, use this API to add a custom source name in Security Lake. This operation creates a partition in the Amazon S3 bucket for Security Lake as the target location for log files from the custom source. In addition, this operation also creates an associated Glue table and an Glue crawler.

INSERT INTO aws.securitylake.log_sources (
configuration,
eventClasses,
sourceName,
sourceVersion,
region
)
SELECT 
'{{ configuration }}' /* required */,
'{{ eventClasses }}',
'{{ sourceName }}' /* required */,
'{{ sourceVersion }}',
'{{ region }}'
RETURNING
source
;

create_aws_log_source

Adds a natively supported Amazon Web Services service as an Amazon Security Lake source. Enables source types for member accounts in required Amazon Web Services Regions, based on the parameters you specify. You can choose any source type in any Region for either accounts that are part of a trusted organization or standalone accounts. Once you add an Amazon Web Services service as a source, Security Lake starts collecting logs and events from it. You can use this API only to enable natively supported Amazon Web Services services as a source. Use CreateCustomLogSource to enable data collection from a custom source.

INSERT INTO aws.securitylake.log_sources (
sources,
region
)
SELECT 
'{{ sources }}' /* required */,
'{{ region }}'
RETURNING
failed
;

Manifest

# Description fields are for documentation purposes
- name: log_sources
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the log_sources resource.
  - name: configuration
    description: |
      The configuration used for the third-party custom source.
    value:
      crawlerConfiguration:
        roleArn: "{{ roleArn }}"
      providerIdentity:
        externalId: "{{ externalId }}"
        principal: "{{ principal }}"
  - name: eventClasses
    value:
      - "{{ eventClasses }}"
  - name: sourceName
    value: "{{ sourceName }}"
  - name: sourceVersion
    value: "{{ sourceVersion }}"
  - name: sources
    value:
      - accounts: "{{ accounts }}"
        regions: "{{ regions }}"
        sourceName: "{{ sourceName }}"
        sourceVersion: "{{ sourceVersion }}"

DELETE examples

delete_aws_log_source

Removes a natively supported Amazon Web Services service as an Amazon Security Lake source. You can remove a source for one or more Regions. When you remove the source, Security Lake stops collecting data from that source in the specified Regions and accounts, and subscribers can no longer consume new data from the source. However, subscribers can still consume data that Security Lake collected from the source before removal. You can choose any source type in any Amazon Web Services Region for either accounts that are part of a trusted organization or standalone accounts.

DELETE FROM aws.securitylake.log_sources
WHERE region = '{{ region }}' --required
;

delete_custom_log_source

Removes a custom log source from Amazon Security Lake, to stop sending data from the custom source to Security Lake.

DELETE FROM aws.securitylake.log_sources
WHERE source_name = '{{ source_name }}' --required
AND region = '{{ region }}' --required
AND sourceVersion = '{{ sourceVersion }}'
;