CustomLogSource

Source: src/AWS/SecurityLake/CustomLogSource.ts

A custom (third-party) log source registered with Amazon Security Lake. Security Lake provisions a Glue crawler, database, and table for the source, plus an IAM role the provider assumes to write OCSF-formatted data into the data lake. Requires SecurityLake.DataLake to already be enabled in the Region.

Every configuration property is create-only — changing any of them replaces the source.

Registering a custom source

const custom = yield* SecurityLake.CustomLogSource("AppLogs", {
  sourceName: "my-app-logs",
  eventClasses: ["FILE_ACTIVITY"],
  crawlerConfiguration: { roleArn: crawlerRole.roleArn },
  providerIdentity: {
    principal: "123456789012",
    externalId: "my-app-external-id",
  },
});