Produces structured summaries of Amazon Security Lake source configuration, subscriber status, and data lake exceptions. Gives operators a rapid view of data lake health without performing data queries.

Works from both standalone and delegated administrator accounts.

Classify the Request

User intent	Workflow
“What sources are configured?”	A: Sources & Ingestion Summary
“Show subscribers” / “Any data lake issues?”	B: Subscriber & Exception Overview

Workflow A: Sources & Ingestion Summary

Get configured sources:
```
aws securitylake get-data-lake-sources
```
List log sources for detail:
```
aws securitylake list-log-sources
```
Check data lake regions:
```
aws securitylake list-data-lakes
```
Present source summary per region:

Region Source Status Account Count
us-east-1 CLOUD_TRAIL_MGMT ACTIVE 12
us-east-1 VPC_FLOW ACTIVE 12
us-east-1 ROUTE53 ACTIVE 8
MUST list all regions where Security Lake is enabled.
SHOULD note any source with non-ACTIVE status.
MAY include custom sources if present.

Region	Source	Status	Account Count
us-east-1	CLOUD_TRAIL_MGMT	ACTIVE	12
us-east-1	VPC_FLOW	ACTIVE	12
us-east-1	ROUTE53	ACTIVE	8

(ONLY if user asks about volume or ingestion size) Query CloudWatch:

aws cloudwatch get-metric-statistics --namespace AWS/SecurityLake --metric-name ProcessedSize --dimensions Name=Source,Value=<SOURCE_NAME> --start-time <7-days-ago> --end-time <now> --period 86400 --statistics Sum

Repeat for each source. Shows total stored bytes per source per day — useful for identifying sources that stopped ingesting.

Workflow B: Subscriber & Exception Overview

List subscribers:
```
aws securitylake list-subscribers
```

For each subscriber:

aws securitylake get-subscriber --subscriber-id <id>

List exceptions:

aws securitylake list-data-lake-exceptions

Present subscriber summary:

Subscriber Access Type Status Sources Subscribed
SIEM-Integration S3 ACTIVE ALL
Analytics-Team LAKEFORMATION ACTIVE VPC_FLOW, CLOUD_TRAIL_MGMT
Present exception summary:

Account Region Source Exception
111122223333 eu-west-1 VPC_FLOW INTERNAL_ERROR
MUST report total subscriber count and access type breakdown.
MUST report exception count — zero exceptions is healthy.
SHOULD note subscribers in non-ACTIVE status.

Subscriber	Access Type	Status	Sources Subscribed
SIEM-Integration	S3	ACTIVE	ALL
Analytics-Team	LAKEFORMATION	ACTIVE	VPC_FLOW, CLOUD_TRAIL_MGMT

Account	Region	Source	Exception
111122223333	eu-west-1	VPC_FLOW	INTERNAL_ERROR

Constraints

MUST NOT perform data queries against Security Lake
MUST NOT modify configuration, subscribers, or sources
MUST NOT query CloudWatch metrics by default — only if user explicitly asks about volume
MUST present data as-is in structured tables
SHOULD handle AccessDeniedException gracefully

Troubleshooting

Symptom	Resolution
get-data-lake-sources returns empty	Security Lake not enabled or no sources configured
AccessDeniedException	Caller is not Security Lake delegated admin or not enabled
UnauthorizedException	Same as above
Subscriber DEACTIVATED	Note in summary — may have been disabled
High exception count	Summarize by account/region — may indicate rollout issues

Output Sensitivity

Source summary reveals data lake regions, per-source ingestion status across accounts, subscriber identities and access configurations, and exception details (account IDs, failure reasons). Present source status table and subscriber overview first. Display full configuration details only when the caller explicitly requests raw output.

references/security-lake-sources.md

Raw file

aws/agent-toolkit-for-aws