AwsLogSource

Source: src/AWS/SecurityLake/AwsLogSource.ts

A natively supported AWS log source (Route 53, VPC Flow Logs, CloudTrail, Security Hub findings, …) enabled for collection into the Security Lake data lake. Requires SecurityLake.DataLake to already be enabled in every configured Region.

Collecting AWS logs

Route 53 resolver query logs

const lake = yield* SecurityLake.DataLake("Lake", {
  configurations: [{ region: "us-west-2" }],
  metaStoreManagerRoleArn: metastoreRole.roleArn,
});
const route53 = yield* SecurityLake.AwsLogSource("Route53Logs", {
  sourceName: "ROUTE53",
  regions: lake.regions,
});

VPC Flow Logs from specific accounts

const vpcFlow = yield* SecurityLake.AwsLogSource("VpcFlow", {
  sourceName: "VPC_FLOW",
  sourceVersion: "2.0",
  regions: ["us-west-2", "us-east-1"],
  accounts: ["123456789012"],
});