steampipe plugin install awssteampipe plugin install aws

Table: aws_securitylake_subscriber

Amazon Security Lake is a fully-managed security data lake service. You can use Security Lake to automatically centralize security data from cloud, on-premises, and custom sources into a data lake that's stored in your account. Security Lake helps you analyze security data, so you can get a more complete understanding of your security posture across the entire organization and improve the protection of your workloads, applications, and data.

Examples

Basic info

select
  subscriber_name,
  subscription_id,
  created_at,
  role_arn,
  s3_bucket_arn,
  subscription_endpoint
from
  aws_securitylake_subscriber;

List subscribers older than 30 days

select
  subscriber_name,
  subscription_id,
  created_at,
  role_arn,
  s3_bucket_arn,
  subscription_endpoint
from
  aws_securitylake_subscriber
where
  created_at <= created_at - interval '30' day;

Get IAM role details for each subscriber

select
  s.subscriber_name,
  s.subscription_id,
  r.arn,
  r.inline_policies,
  r.attached_policy_arns,
  r.assume_role_policy
from
  aws_securitylake_subscriber as s,
  aws_iam_role as r
where
  s.role_arn = r.arn;

Get S3 bucket details for each subscriber

select
  s.subscriber_name,
  s.subscription_id,
  b.arn,
  b.event_notification_configuration,
  b.server_side_encryption_configuration,
  b.acl
from
  aws_securitylake_subscriber as s,
  aws_s3_bucket as b
where
  s.s3_bucket_arn = b.arn;

List subscribers that are not active

select
  subscriber_name,
  created_at,
  subscription_status,
  s3_bucket_arn,
  sns_arn
from
  aws_securitylake_subscriber
where
  subscription_status <> 'ACTIVE';

.inspect aws_securitylake_subscriber

AWS Security Lake Subscriber

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
access_types	jsonb	You can choose to notify subscribers of new objects with an Amazon Simple Queue Service (Amazon SQS) queue or through messaging to an HTTPS endpoint provided by the subscriber. Subscribers can consume data by directly querying Lake Formation tables in your S3 bucket via services like Amazon Athena. This subscription type is defined as LAKEFORMATION.
account_id	text	The AWS Account ID in which the resource is located.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
created_at	timestamp with time zone	The date and time when the subscription was created.
external_id	text	The external ID of the subscriber.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
region	text	The AWS Region in which the resource is located.
role_arn	text	The Amazon Resource Name (ARN) specifying the role of the subscriber.
s3_bucket_arn	text	The Amazon Resource Name (ARN) for the Amazon S3 bucket.
sns_arn	text	The Amazon Resource Name (ARN) for the Amazon Simple Notification Service.
source_types	jsonb	Amazon Security Lake supports logs and events collection for the natively-supported Amazon Web Services services.
subscriber_description	text	The subscriber descriptions for a subscriber account.
subscriber_name	text	The name of your Amazon Security Lake subscriber account.
subscription_endpoint	text	The subscription endpoint to which exception messages are posted.
subscription_id	text	The subscription ID of the Amazon Security Lake subscriber account.
subscription_protocol	text	The subscription protocol to which exception messages are posted.
subscription_status	text	Subscription status of the Amazon Security Lake subscriber account.
title	text	Title of the resource.
updated_at	timestamp with time zone	The date and time when the subscription was updated.

turbot/aws