Amazon Security Lake Log Sources API

openapi: 3.1.0
info:
  title: Amazon Security Lake Log Sources API
  version: '2018-05-10'
  description: Generated from AWS's published Smithy model for Amazon Security Lake. 4 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://securitylake.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
paths:
  /v1/datalake/logsources/aws:
    post:
      operationId: CreateAwsLogSource
      summary: Create Aws Log Source
      description: Adds a natively supported Amazon Web Services service as an Amazon Security Lake source. Enables source
        types for member accounts in required Amazon Web Services Regions, based on the parameters you specify. You can choose
        any source type in any Region for either accounts that are part of a trusted organization or standalone accounts.
        Once you add an Amazon Web Services service as a source, Security Lake starts collecting logs and events from it.
        You can use this API only to enable natively supported Amazon Web Services services as a source. Use CreateCustomLogSource
        to enable data collection from a custom source.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateAwsLogSourceResponse'
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '409':
          description: ConflictException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateAwsLogSourceRequest'
      tags:
      - Log Sources
  /v1/datalake/logsources/custom:
    post:
      operationId: CreateCustomLogSource
      summary: Create Custom Log Source
      description: Adds a third-party custom source in Amazon Security Lake, from the Amazon Web Services Region where you
        want to create a custom source. Security Lake can collect logs and events from third-party custom sources. After creating
        the appropriate IAM role to invoke Glue crawler, use this API to add a custom source name in Security Lake. This operation
        creates a partition in the Amazon S3 bucket for Security Lake as the target location for log files from the custom
        source. In addition, this operation also creates an associated Glue table and an Glue crawler.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateCustomLogSourceResponse'
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '409':
          description: ConflictException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateCustomLogSourceRequest'
      tags:
      - Log Sources
  /v1/datalake/sources:
    post:
      operationId: GetDataLakeSources
      summary: Get Data Lake Sources
      description: Retrieves a snapshot of the current Region, including whether Amazon Security Lake is enabled for those
        accounts and which sources Security Lake is collecting data from.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetDataLakeSourcesResponse'
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '409':
          description: ConflictException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetDataLakeSourcesRequest'
      tags:
      - Log Sources
  /v1/datalake/logsources/list:
    post:
      operationId: ListLogSources
      summary: List Log Sources
      description: Retrieves the log sources.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListLogSourcesResponse'
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '409':
          description: ConflictException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListLogSourcesRequest'
      tags:
      - Log Sources
components:
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical
        request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: securitylake
  schemas:
    AccessDeniedException:
      type: object
      properties:
        message:
          type: string
        errorCode:
          type: string
          description: A coded string to provide more information about the access denied exception. You can use the error
            code to check the exception type.
    AwsIdentity:
      type: object
      properties:
        principal:
          type: string
          description: The Amazon Web Services identity principal.
        externalId:
          type: string
          description: The external ID used to establish trust relationship with the Amazon Web Services identity.
      required:
      - principal
      - externalId
    AwsLogSourceConfiguration:
      type: object
      properties:
        accounts:
          type: array
          items:
            type: string
          description: Specify the Amazon Web Services account information where you want to enable Security Lake.
        regions:
          type: array
          items:
            type: string
          description: Specify the Regions where you want to enable Security Lake.
        sourceName:
          type: string
          enum:
          - ROUTE53
          - VPC_FLOW
          - SH_FINDINGS
          - CLOUD_TRAIL_MGMT
          - LAMBDA_EXECUTION
          - S3_DATA
          - EKS_AUDIT
          - WAF
          description: The name for a Amazon Web Services source.
        sourceVersion:
          type: string
          description: The version for a Amazon Web Services source.
      required:
      - regions
      - sourceName
    AwsLogSourceResource:
      type: object
      properties:
        sourceName:
          type: string
          enum:
          - ROUTE53
          - VPC_FLOW
          - SH_FINDINGS
          - CLOUD_TRAIL_MGMT
          - LAMBDA_EXECUTION
          - S3_DATA
          - EKS_AUDIT
          - WAF
          description: The name for a Amazon Web Services source. This must be a Regionally unique value.
        sourceVersion:
          type: string
          description: The version for a Amazon Web Services source. This must be a Regionally unique value.
    BadRequestException:
      type: object
      properties:
        message:
          type: string
    ConflictException:
      type: object
      properties:
        message:
          type: string
        resourceName:
          type: string
          description: The resource name.
        resourceType:
          type: string
          description: The resource type.
    CreateAwsLogSourceRequest:
      type: object
      properties:
        sources:
          type: array
          items:
            $ref: '#/components/schemas/AwsLogSourceConfiguration'
          description: Specify the natively-supported Amazon Web Services service to add as a source in Security Lake.
      required:
      - sources
    CreateAwsLogSourceResponse:
      type: object
      properties:
        failed:
          type: array
          items:
            type: string
          description: Lists all accounts in which enabling a natively supported Amazon Web Services service as a Security
            Lake source failed. The failure occurred as these accounts are not part of an organization.
    CreateCustomLogSourceRequest:
      type: object
      properties:
        sourceName:
          type: string
          description: Specify the name for a third-party custom source. This must be a Regionally unique value. The sourceName
            you enter here, is used in the LogProviderRole name which follows the convention AmazonSecurityLake-Provider-{name
            of the custom source}-{region}. You must use a CustomLogSource name that is shorter than or equal to 20 characters.
            This ensures that the LogProviderRole name is below the 64 character limit.
        sourceVersion:
          type: string
          description: Specify the source version for the third-party custom source, to limit log collection to a specific
            version of custom data source.
        eventClasses:
          type: array
          items:
            type: string
          description: The Open Cybersecurity Schema Framework (OCSF) event classes which describes the type of data that
            the custom source will send to Security Lake. For the list of supported event classes, see the Amazon Security
            Lake User Guide.
        configuration:
          $ref: '#/components/schemas/CustomLogSourceConfiguration'
      required:
      - sourceName
      - configuration
    CreateCustomLogSourceResponse:
      type: object
      properties:
        source:
          $ref: '#/components/schemas/CustomLogSourceResource'
    CustomLogSourceAttributes:
      type: object
      properties:
        crawlerArn:
          type: string
          description: The ARN of the Glue crawler.
        databaseArn:
          type: string
          description: 'The ARN of the Glue database where results are written, such as: arn:aws:daylight:us-east-1::database/sometable/*.'
        tableArn:
          type: string
          description: The ARN of the Glue table.
    CustomLogSourceConfiguration:
      type: object
      properties:
        crawlerConfiguration:
          $ref: '#/components/schemas/CustomLogSourceCrawlerConfiguration'
        providerIdentity:
          $ref: '#/components/schemas/AwsIdentity'
      required:
      - crawlerConfiguration
      - providerIdentity
    CustomLogSourceCrawlerConfiguration:
      type: object
      properties:
        roleArn:
          type: string
          description: 'The Amazon Resource Name (ARN) of the Identity and Access Management (IAM) role to be used by the
            Glue crawler. The recommended IAM policies are: The managed policy AWSGlueServiceRole A custom policy granting
            access to your Amazon S3 Data Lake'
      required:
      - roleArn
    CustomLogSourceProvider:
      type: object
      properties:
        roleArn:
          type: string
          description: The ARN of the IAM role to be used by the entity putting logs into your custom source partition. Security
            Lake will apply the correct access policies to this role, but you must first manually create the trust policy
            for this role. The IAM role name must start with the text 'Security Lake'. The IAM role must trust the logProviderAccountId
            to assume the role.
        location:
          type: string
          description: The location of the partition in the Amazon S3 bucket for Security Lake.
    CustomLogSourceResource:
      type: object
      properties:
        sourceName:
          type: string
          description: The name for a third-party custom source. This must be a Regionally unique value.
        sourceVersion:
          type: string
          description: The version for a third-party custom source. This must be a Regionally unique value.
        provider:
          $ref: '#/components/schemas/CustomLogSourceProvider'
        attributes:
          $ref: '#/components/schemas/CustomLogSourceAttributes'
    DataLakeSource:
      type: object
      properties:
        account:
          type: string
          description: The ID of the Security Lake account for which logs are collected.
        sourceName:
          type: string
          description: The supported Amazon Web Services services from which logs and events are collected. Amazon Security
            Lake supports log and event collection for natively supported Amazon Web Services services.
        eventClasses:
          type: array
          items:
            type: string
          description: The Open Cybersecurity Schema Framework (OCSF) event classes describes the type of data that the custom
            source will send to Security Lake. For the list of supported event classes, see Supported OCSF Event classes in
            the Amazon Security Lake User Guide.
        sourceStatuses:
          type: array
          items:
            $ref: '#/components/schemas/DataLakeSourceStatus'
          description: The log status for the Security Lake account.
    DataLakeSourceStatus:
      type: object
      properties:
        resource:
          type: string
          description: Defines path the stored logs are available which has information on your systems, applications, and
            services.
        status:
          type: string
          enum:
          - COLLECTING
          - MISCONFIGURED
          - NOT_COLLECTING
          description: The health status of services, including error codes and patterns.
    GetDataLakeSourcesRequest:
      type: object
      properties:
        accounts:
          type: array
          items:
            type: string
          description: The Amazon Web Services account ID for which a static snapshot of the current Amazon Web Services Region,
            including enabled accounts and log sources, is retrieved.
        maxResults:
          type: integer
          description: The maximum limit of accounts for which the static snapshot of the current Region, including enabled
            accounts and log sources, is retrieved.
        nextToken:
          type: string
          description: Lists if there are more results available. The value of nextToken is a unique pagination token for
            each page. Repeat the call using the returned token to retrieve the next page. Keep all other arguments unchanged.
            Each pagination token expires after 24 hours. Using an expired pagination token will return an HTTP 400 InvalidToken
            error.
    GetDataLakeSourcesResponse:
      type: object
      properties:
        dataLakeArn:
          type: string
          description: The Amazon Resource Name (ARN) created by you to provide to the subscriber. For more information about
            ARNs and how to use them in policies, see the Amazon Security Lake User Guide.
        dataLakeSources:
          type: array
          items:
            $ref: '#/components/schemas/DataLakeSource'
          description: The list of enabled accounts and enabled sources.
        nextToken:
          type: string
          description: Lists if there are more results available. The value of nextToken is a unique pagination token for
            each page. Repeat the call using the returned token to retrieve the next page. Keep all other arguments unchanged.
            Each pagination token expires after 24 hours. Using an expired pagination token will return an HTTP 400 InvalidToken
            error.
    InternalServerException:
      type: object
      properties:
        message:
          type: string
    ListLogSourcesRequest:
      type: object
      properties:
        accounts:
          type: array
          items:
            type: string
          description: The list of Amazon Web Services accounts for which log sources are displayed.
        regions:
          type: array
          items:
            type: string
          description: The list of Regions for which log sources are displayed.
        sources:
          type: array
          items:
            $ref: '#/components/schemas/LogSourceResource'
          description: The list of sources for which log sources are displayed.
        maxResults:
          type: integer
          description: The maximum number of accounts for which the log sources are displayed.
        nextToken:
          type: string
          description: If nextToken is returned, there are more results available. You can repeat the call using the returned
            token to retrieve the next page.
    ListLogSourcesResponse:
      type: object
      properties:
        sources:
          type: array
          items:
            $ref: '#/components/schemas/LogSource'
          description: The list of log sources in your organization that send data to the data lake.
        nextToken:
          type: string
          description: If nextToken is returned, there are more results available. You can repeat the call using the returned
            token to retrieve the next page.
    LogSource:
      type: object
      properties:
        account:
          type: string
          description: Specify the account from which you want to collect logs.
        region:
          type: string
          description: Specify the Regions from which you want to collect logs.
        sources:
          type: array
          items:
            $ref: '#/components/schemas/LogSourceResource'
          description: Specify the sources from which you want to collect logs.
    LogSourceResource:
      type: object
      properties:
        awsLogSource:
          $ref: '#/components/schemas/AwsLogSourceResource'
        customLogSource:
          $ref: '#/components/schemas/CustomLogSourceResource'
      description: Exactly one member is set.
    ResourceNotFoundException:
      type: object
      properties:
        message:
          type: string
        resourceName:
          type: string
          description: The name of the resource that could not be found.
        resourceType:
          type: string
          description: The type of the resource that could not be found.
    ThrottlingException:
      type: object
      properties:
        message:
          type: string
        serviceCode:
          type: string
          description: The code for the service in Service Quotas.
        quotaCode:
          type: string
          description: That the rate of requests to Security Lake is exceeding the request quotas for your Amazon Web Services
            account.
        retryAfterSeconds:
          type: integer
          description: Retry the request after the specified time.
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/3cd98287b471c106254abd89279cc87308d38bfd/models/securitylake/service/2018-05-10/securitylake-2018-05-10.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)