Amazon Web Services Datalake API

openapi: 3.1.0
info:
  title: Amazon Web Services accessanalyzer 2012 09 25 Datalake API
  description: <p>Identity and Access Management Access Analyzer helps you to set, verify, and refine your IAM policies by providing a suite of capabilities. Its features include findings for external and unused access, basic and custom policy checks for validating policies, and policy generation to generate fine-grained policies. To start using IAM Access Analyzer to identify external or unused access, you first need to create an analyzer.</p> <p> <b>External access analyzers</b> help identify potential risks of accessing resources by enabling you to identify any resource policies that grant access to an external principal. It does this by using logic-based reasoning to analyze resource-based policies in your Amazon Web Services environment. An external principal can be another Amazon Web Services account, a root user, an IAM user or role, a federated user, an Amazon Web Services service, or an anonymous user. You can also use IAM Access Analyzer to preview public and cross-account access to your resources before deploying permissions changes.</p> <p> <b>Unused access analyzers</b> help identify potential identity access risks by enabling you to identify unused IAM roles, unused access keys, unused console passwords, and IAM principals with unused service and action-level permissions.</p> <p>Beyond findings, IAM Access Analyzer provides basic and custom policy checks to validate IAM policies before deploying permissions changes. You can use policy generation to refine permissions by attaching a policy generated using access activity logged in CloudTrail logs. </p> <p>This guide describes the IAM Access Analyzer operations that you can call programmatically. For general information about IAM Access Analyzer, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html">Identity and Access Management Access Analyzer</a> in the <b>IAM User Guide</b>.</p>
tags:
- name: Datalake
paths:
  /v1/datalake/logsources/aws:
    POST:
      summary: Amazon Web Services Createawslogsource
      description: Adds a natively supported Amazon Web Service as an Amazon Security Lake source. Enables source types for member accounts in required Amazon Web Services Regions, based on the parameters you specify. You can choose any source type in any Region for either accounts that are part of a trusted organization or standalone accounts. Once you add an Amazon Web Service as a source, Security Lake starts collecting logs and events from it. You can use this API only to enable natively supported Amazon Web Services as a source. Use CreateCustomLogSource to enable data collection from a custom source.
      operationId: amazonWebServicesCreateAwsLogSource
      tags:
      - Datalake
  /v1/datalake/logsources/custom:
    POST:
      summary: Amazon Web Services Createcustomlogsource
      description: Adds a third-party custom source in Amazon Security Lake, from the Amazon Web Services Region where you want to create a custom source. Security Lake can collect logs and events from third-party custom sources. After creating the appropriate IAM role to invoke Glue crawler, use this API to add a custom source name in Security Lake. This operation creates a partition in the Amazon S3 bucket for Security Lake as the target location for log files from the custom source. In addition, this operation also creates an associated Glue table and an Glue crawler.
      operationId: amazonWebServicesCreateCustomLogSource
      tags:
      - Datalake
  /v1/datalake:
    PUT:
      summary: Amazon Web Services Updatedatalake
      description: Specifies where to store your security data and for how long. You can add a rollup Region to consolidate data from multiple Amazon Web Services Regions.
      operationId: amazonWebServicesUpdateDataLake
      tags:
      - Datalake
  /v1/datalake/exceptions/subscription:
    PUT:
      summary: Amazon Web Services Updatedatalakeexceptionsubscription
      description: Updates the specified notification subscription in Amazon Security Lake for the organization you specify.
      operationId: amazonWebServicesUpdateDataLakeExceptionSubscription
      tags:
      - Datalake
  /v1/datalake/organization/configuration:
    GET:
      summary: Amazon Web Services Getdatalakeorganizationconfiguration
      description: Retrieves the configuration that will be automatically set up for accounts added to the organization after the organization has onboarded to Amazon Security Lake. This API does not take input parameters.
      operationId: amazonWebServicesGetDataLakeOrganizationConfiguration
      tags:
      - Datalake
  /v1/datalake/logsources/aws/delete:
    POST:
      summary: Amazon Web Services Deleteawslogsource
      description: 'Removes a natively supported Amazon Web Service as an Amazon Security Lake source. You can remove a source for one or more Regions. When you remove the source, Security Lake stops collecting data from that source in the specified Regions and accounts, and subscribers can no longer consume new data from the source. However, subscribers can still consume data that Security Lake collected from the source before removal. You can choose any source type in any Amazon Web Services Region for either accounts that are part of a trusted organization or standalone accounts. '
      operationId: amazonWebServicesDeleteAwsLogSource
      tags:
      - Datalake
  /v1/datalake/logsources/custom/{sourceName}:
    DELETE:
      summary: Amazon Web Services Deletecustomlogsource
      description: Removes a custom log source from Amazon Security Lake, to stop sending data from the custom source to Security Lake.
      operationId: amazonWebServicesDeleteCustomLogSource
      tags:
      - Datalake
  /v1/datalake/delete:
    POST:
      summary: Amazon Web Services Deletedatalake
      description: When you disable Amazon Security Lake from your account, Security Lake is disabled in all Amazon Web Services Regions and it stops collecting data from your sources. Also, this API automatically takes steps to remove the account from Security Lake. However, Security Lake retains all of your existing settings and the resources that it created in your Amazon Web Services account in the current Amazon Web Services Region. The DeleteDataLake operation does not delete the data that is stored in your Amazon S3 bucket, which is owned by your Amazon Web Services account. For more information, see the Amazon Security Lake User Guide.
      operationId: amazonWebServicesDeleteDataLake
      tags:
      - Datalake
  /v1/datalake/organization/configuration/delete:
    POST:
      summary: Amazon Web Services Deletedatalakeorganizationconfiguration
      description: Turns off automatic enablement of Amazon Security Lake for member accounts that are added to an organization in Organizations. Only the delegated Security Lake administrator for an organization can perform this operation. If the delegated Security Lake administrator performs this operation, new member accounts won't automatically contribute data to the data lake.
      operationId: amazonWebServicesDeleteDataLakeOrganizationConfiguration
      tags:
      - Datalake
  /v1/datalake/delegate:
    POST:
      summary: Amazon Web Services Registerdatalakedelegatedadministrator
      description: Designates the Amazon Security Lake delegated administrator account for the organization. This API can only be called by the organization management account. The organization management account cannot be the delegated administrator account.
      operationId: amazonWebServicesRegisterDataLakeDelegatedAdministrator
      tags:
      - Datalake
  /v1/datalake/sources:
    POST:
      summary: Amazon Web Services Getdatalakesources
      description: Retrieves a snapshot of the current Region, including whether Amazon Security Lake is enabled for those accounts and which sources Security Lake is collecting data from.
      operationId: amazonWebServicesGetDataLakeSources
      tags:
      - Datalake
  /v1/datalake/exceptions:
    POST:
      summary: Amazon Web Services Listdatalakeexceptions
      description: Lists the Amazon Security Lake exceptions that you can use to find the source of problems and fix them.
      operationId: amazonWebServicesListDataLakeExceptions
      tags:
      - Datalake
  /v1/datalake/logsources/list:
    POST:
      summary: Amazon Web Services Listlogsources
      description: Retrieves the log sources in the current Amazon Web Services Region.
      operationId: amazonWebServicesListLogSources
      tags:
      - Datalake