Security Lake

4 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

SecurityLakeAwsLogSource # CLOUD CONTROL · AWS::SecurityLake::AwsLogSource

SecurityLakeAwsLogSource manages AWS::SecurityLake::AwsLogSource through the AWS Cloud Control API.

kubectl get securitylakeawslogsources · example on GitHub

Example

# SecurityLakeAwsLogSource — Security Lake
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securitylake.html#securitylakeawslogsource
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityLakeAwsLogSource
metadata:
  name: example-securitylakeawslogsource
  namespace: default
spec:
  accounts:
  - example
  dataLakeArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-securitylakeawslogsource
    region: us-east-1
  sourceName: example-securitylakeawslogsource
  sourceVersion: '1.0'

Spec

Field	Type	Required	Description
`accounts`	array<string>	—	AWS account where you want to collect logs from.
`dataLakeArn`	string	yes	The ARN for the data lake.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`sourceName`	string	yes	The name for a AWS source.
`sourceVersion`	string	yes	The version for a AWS source.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

SecurityLakeDataLake # CLOUD CONTROL · AWS::SecurityLake::DataLake

SecurityLakeDataLake manages AWS::SecurityLake::DataLake through the AWS Cloud Control API.

kubectl get securitylakedatalakes · example on GitHub

Example

# SecurityLakeDataLake — Security Lake
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securitylake.html#securitylakedatalake
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityLakeDataLake
metadata:
  name: example-securitylakedatalake
  namespace: default
spec:
  encryptionConfiguration:
    kmsKeyId: arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab
  lifecycleConfiguration:
    expiration:
      days: 1
    transitions:
    - days: 1
      storageClass: example
  metaStoreManagerRoleArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-securitylakedatalake
    region: us-east-1
  replicationConfiguration:
    regions:
    - example
    roleArn: arn:aws:iam::123456789012:role/example-role
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`encryptionConfiguration`	object	—	SecurityLakeDataLakeEncryptionConfiguration is a nested property type of AWS::SecurityLake::DataLake.
`encryptionConfiguration.kmsKeyId`	string	—	The id of KMS encryption key used by Amazon Security Lake to encrypt the Security Lake object.
`lifecycleConfiguration`	object	—	SecurityLakeDataLakeLifecycleConfiguration is a nested property type of AWS::SecurityLake::DataLake.
`lifecycleConfiguration.expiration`	object	—	SecurityLakeDataLakeExpiration is a nested property type of AWS::SecurityLake::DataLake.
`lifecycleConfiguration.expiration.days`	integer	—
`lifecycleConfiguration.transitions`	array<object>	—	Provides data storage transition details of Amazon Security Lake object.
`lifecycleConfiguration.transitions[].days`	integer	—	Number of days before data transitions to a different S3 Storage Class in the Amazon Security Lake object.
`lifecycleConfiguration.transitions[].storageClass`	string	—	The range of storage classes that you can choose from based on the data access, resiliency, and cost requirements of your workloads.
`metaStoreManagerRoleArn`	string	—	The Amazon Resource Name (ARN) used to index AWS Glue table partitions that are generated by the ingestion and normalization of AWS log sources and custom sources.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`replicationConfiguration`	object	—	SecurityLakeDataLakeReplicationConfiguration is a nested property type of AWS::SecurityLake::DataLake.
`replicationConfiguration.regions`	array<string>	—
`replicationConfiguration.roleArn`	string	—	Replication settings for the Amazon S3 buckets.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) created by you to provide to the subscriber.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`s3BucketArn`	string	—	The ARN for the Amazon Security Lake Amazon S3 bucket.

SecurityLakeSubscriber # CLOUD CONTROL · AWS::SecurityLake::Subscriber

SecurityLakeSubscriber manages AWS::SecurityLake::Subscriber through the AWS Cloud Control API.

kubectl get securitylakesubscribers · example on GitHub

Example

# SecurityLakeSubscriber — Security Lake
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securitylake.html#securitylakesubscriber
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityLakeSubscriber
metadata:
  name: example-securitylakesubscriber
  namespace: default
spec:
  accessTypes:
  - example
  dataLakeArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-securitylakesubscriber
    region: us-east-1
  sources:
  - awsLogSource:
      sourceName: example-securitylakesubscriber
      sourceVersion: '1.0'
    customLogSource:
      sourceName: example-securitylakesubscriber
      sourceVersion: '1.0'
  subscriberDescription: Managed by konfig-konector
  subscriberIdentity:
    externalId: example-id
    principal: example
  subscriberName: example-securitylakesubscriber
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`accessTypes`	array<string>	yes
`dataLakeArn`	string	yes	The ARN for the data lake.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`sources`	array<object>	yes	The supported AWS services from which logs and events are collected.
`sources[].awsLogSource`	object	—	SecurityLakeSubscriberAwsLogSource is a nested property type of AWS::SecurityLake::Subscriber.
`sources[].awsLogSource.sourceName`	string	—	The name for a AWS source.
`sources[].awsLogSource.sourceVersion`	string	—	The version for a AWS source.
`sources[].customLogSource`	object	—	SecurityLakeSubscriberCustomLogSource is a nested property type of AWS::SecurityLake::Subscriber.
`sources[].customLogSource.sourceName`	string	—	The name for a third-party custom source.
`sources[].customLogSource.sourceVersion`	string	—	The version for a third-party custom source.
`subscriberDescription`	string	—	The description for your subscriber account in Security Lake.
`subscriberIdentity`	object	yes	The AWS identity used to access your data.
`subscriberIdentity.externalId`	string	yes	The external ID used to establish trust relationship with the AWS identity.
`subscriberIdentity.principal`	string	yes	The AWS identity principal.
`subscriberName`	string	yes	The name of your Security Lake subscriber account.
`tags`	array<object>	—	An array of objects, one for each tag to associate with the subscriber.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`resourceShareArn`	string	—	Read-only: reported by AWS after creation.
`resourceShareName`	string	—	Read-only: reported by AWS after creation.
`s3BucketArn`	string	—	Read-only: reported by AWS after creation.
`subscriberArn`	string	—	Read-only: reported by AWS after creation.
`subscriberRoleArn`	string	—	Read-only: reported by AWS after creation.

SecurityLakeSubscriberNotification # CLOUD CONTROL · AWS::SecurityLake::SubscriberNotification

SecurityLakeSubscriberNotification manages AWS::SecurityLake::SubscriberNotification through the AWS Cloud Control API.

kubectl get securitylakesubscribernotifications · example on GitHub

Example

# SecurityLakeSubscriberNotification — Security Lake
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securitylake.html#securitylakesubscribernotification
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityLakeSubscriberNotification
metadata:
  name: example-securitylakesubscribernotification
  namespace: default
spec:
  notificationConfiguration:
    httpsNotificationConfiguration:
      authorizationApiKeyName: example-securitylakesubscribernotification
      authorizationApiKeyValue: example
      endpoint: example
      httpMethod: POST
      targetRoleArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-securitylakesubscribernotification
    region: us-east-1
  subscriberArn: arn:aws:iam::123456789012:role/example-role

Spec

Field	Type	Required	Description
`notificationConfiguration`	object	yes	SecurityLakeSubscriberNotificationNotificationConfiguration is a nested property type of AWS::SecurityLake::SubscriberNotification.
`notificationConfiguration.httpsNotificationConfiguration`	object	—	SecurityLakeSubscriberNotificationHttpsNotificationConfiguration is a nested property type of AWS::SecurityLake::SubscriberNotification.
`notificationConfiguration.httpsNotificationConfiguration.authorizationApiKeyName`	string	—	The key name for the notification subscription.
`notificationConfiguration.httpsNotificationConfiguration.authorizationApiKeyValue`	string	—	The key value for the notification subscription.
`notificationConfiguration.httpsNotificationConfiguration.endpoint`	string	yes	The subscription endpoint in Security Lake.
`notificationConfiguration.httpsNotificationConfiguration.httpMethod`	enum	—	The HTTPS method used for the notification subscription. Allowed: `POST, PUT`
`notificationConfiguration.httpsNotificationConfiguration.targetRoleArn`	string	yes	The Amazon Resource Name (ARN) of the EventBridge API destinations IAM role that you created.
`notificationConfiguration.sqsNotificationConfiguration`	object	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`subscriberArn`	string	yes	The ARN for the subscriber Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`subscriberEndpoint`	string	—	The endpoint the subscriber should listen to for notifications Read-only: reported by AWS after creation.