Summarizing Security Lake Sources
Overview
Produces structured summaries of Amazon Security Lake source configuration, subscriber status, and data lake exceptions. Gives operators a rapid view of data lake health without performing data queries.
Works from both standalone and delegated administrator accounts.
Classify the Request
| User intent | Workflow |
|---|---|
| "What sources are configured?" | A: Sources & Ingestion Summary |
| "Show subscribers" / "Any data lake issues?" | B: Subscriber & Exception Overview |
Workflow A: Sources & Ingestion Summary
Get configured sources:
aws securitylake get-data-lake-sourcesList log sources for detail:
aws securitylake list-log-sourcesCheck data lake regions:
aws securitylake list-data-lakesPresent source summary per region:
Region Source Status Account Count us-east-1 CLOUD_TRAIL_MGMT ACTIVE 12 us-east-1 VPC_FLOW ACTIVE 12 us-east-1 ROUTE53 ACTIVE 8 MUST list all regions where Security Lake is enabled.
SHOULD note any source with non-ACTIVE status.
MAY include custom sources if present.
(ONLY if user asks about volume or ingestion size) Query CloudWatch:
aws cloudwatch get-metric-statistics --namespace AWS/SecurityLake --metric-name ProcessedSize --dimensions Name=Source,Value=<SOURCE_NAME> --start-time <7-days-ago> --end-time <now> --period 86400 --statistics SumRepeat for each source. Shows total stored bytes per source per day — useful for identifying sources that stopped ingesting.
Workflow B: Subscriber & Exception Overview
List subscribers:
aws securitylake list-subscribersFor each subscriber:
aws securitylake get-subscriber --subscriber-id <id>List exceptions:
aws securitylake list-data-lake-exceptionsPresent subscriber summary:
Subscriber Access Type Status Sources Subscribed SIEM-Integration S3 ACTIVE ALL Analytics-Team LAKEFORMATION ACTIVE VPC_FLOW, CLOUD_TRAIL_MGMT Present exception summary:
Account Region Source Exception 111122223333 eu-west-1 VPC_FLOW INTERNAL_ERROR MUST report total subscriber count and access type breakdown.
MUST report exception count — zero exceptions is healthy.
SHOULD note subscribers in non-ACTIVE status.
Constraints
- MUST NOT perform data queries against Security Lake
- MUST NOT modify configuration, subscribers, or sources
- MUST NOT query CloudWatch metrics by default — only if user explicitly asks about volume
- MUST present data as-is in structured tables
- SHOULD handle AccessDeniedException gracefully
Troubleshooting
| Symptom | Resolution |
|---|---|
| get-data-lake-sources returns empty | Security Lake not enabled or no sources configured |
| AccessDeniedException | Caller is not Security Lake delegated admin or not enabled |
| UnauthorizedException | Same as above |
| Subscriber DEACTIVATED | Note in summary — may have been disabled |
| High exception count | Summarize by account/region — may indicate rollout issues |
Output Sensitivity
Source summary reveals data lake regions, per-source ingestion status across accounts, subscriber identities and access configurations, and exception details (account IDs, failure reasons). Present source status table and subscriber overview first. Display full configuration details only when the caller explicitly requests raw output.