Setting the file. One moment.
Subchapter 41.20
references/security-lake-configuration.mdMarkdown4 KBView on GitHub
Produces a configuration summary of Amazon Security Lake reporting current state. Verifies data lake enablement, AWS log source coverage, subscriber setup, and organization-level rollout.
Works from both standalone and delegated administrator accounts.
| Request Pattern | Workflow |
|---|---|
| “Is Security Lake configured correctly?” | A: Review Single Account |
| “Check org-wide Security Lake coverage” | B: Review Organization Coverage |
Check data lake status:
aws securitylake list-data-lakesVerify each expected region has a data lake with createStatus = COMPLETED.
Security check: Verify data lake has KMS encryption configured — check encryptionConfiguration.kmsKeyId in the list-data-lakes output.
Check configured AWS sources:
aws securitylake get-data-lake-sourcesVerify these source types are present:
List log sources for detail:
aws securitylake list-log-sourcesCheck subscribers:
aws securitylake list-subscribersFor each subscriber, note access type (S3, LAKEFORMATION) and status.
Present results:
| Check | Status | Detail |
|---|---|---|
| Data lake enabled (region) | Configured | createStatus=COMPLETED |
| CloudTrail Management | Configured / Not Configured | … |
| VPC Flow Logs | Configured / Not Configured | … |
| Route53 | Configured / Not Configured | … |
| S3 Data Events | Configured / Not Configured | … |
| Lambda Execution | Configured / Not Configured | … |
| EKS Audit | Configured / Not Configured | … |
| Subscribers | Configured | N subscribers active |
MUST check all standard AWS sources listed above.
SHOULD flag any source with a non-healthy status.
Get organization configuration:
aws securitylake get-data-lake-organization-configurationCheck which sources have auto-enable configured.
List exceptions:
aws securitylake list-data-lake-exceptionsIdentify accounts/regions with failures.
Present organization summary:
| Check | Status | Detail |
|---|---|---|
| Org auto-enable (each source) | Configured / Not Configured | … |
| Exceptions | Count | … |
For each exception:
| Account | Region | Source | Exception Reason |
|---|---|---|---|
| 111122223333 | us-east-1 | VPC_FLOW | INTERNAL_ERROR |
MUST report all exceptions.
SHOULD compare auto-enable sources against full source list.
MUST NOT paginate through all member accounts by default.
MUST only enumerate individual member status if user explicitly requests it.
| Issue | Resolution |
|---|---|
| list-data-lakes returns empty | Security Lake not enabled in this account/region |
| AccessDeniedException | Caller is not the Security Lake delegated admin or not enabled. Note: may have empty error body |
| UnauthorizedException | Same as above |
| get-data-lake-organization-configuration fails | Organization features may not be enabled |
| Sources show FAILED status | Note in report — may indicate IAM or SLR issues |
Configuration output reveals data lake S3 bucket details, KMS key ARNs, subscriber identities and access types, log source coverage across accounts and regions, and organization exception details. Present source enablement and subscriber summary first; offer raw API responses on request.