DataLake

Source: src/AWS/SecurityLake/DataLake.ts

The Amazon Security Lake data lake — the account-wide singleton that onboards the account to Security Lake. Enabling it creates S3 buckets, registers them with Lake Formation, and configures the Glue metastore in every configured Region.

This is a heavyweight, account-wide resource: enabling/disabling Security Lake affects the whole account, and the S3 buckets it creates are retained after the data lake is deleted.

Enabling Security Lake

Single-Region data lake

const lake = yield* SecurityLake.DataLake("Lake", {
  configurations: [{ region: "us-west-2" }],
  metaStoreManagerRoleArn: metastoreRole.roleArn,
});

Lifecycle management and KMS encryption

const lake = yield* SecurityLake.DataLake("Lake", {
  configurations: [
    {
      region: "us-west-2",
      encryptionConfiguration: { kmsKeyId: key.keyId },
      lifecycleConfiguration: {
        expiration: { days: "365 days" },
        transitions: [{ storageClass: "ONEZONE_IA", days: "30 days" }],
      },
    },
  ],
  metaStoreManagerRoleArn: metastoreRole.roleArn,
  tags: { team: "security" },
});