aws securitylake get-data-lake-sources

Retrieves a snapshot of the current Region, including whether Amazon Security Lake is enabled for those accounts and which sources Security Lake is collecting data from. AWS CLI reference

1 example 3 options Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

To get the status of log collection

The following get-data-lake-sources example gets a snapshot of log collection for the specified account in the current AWS Region. The account has Amazon Security Lake enabled.

aws securitylake get-data-lake-sources --accounts "123456789012"Identify

--accountsThe Amazon Web Services account ID for which a static snapshot of the current Amazon Web Services Region, including enabled accounts and log sources, is retrieved.

Its output, shortened

{
    "dataLakeSources": [
        {
            "account": "123456789012",
            "sourceName": "SH_FINDINGS",
            "sourceStatuses": [
                {
                    "resource": "vpc-1234567890abcdef0",
                    "status": "COLLECTING"
                }
            ]
        },
        {
            "account": "123456789012",
            "sourceName": "VPC_FLOW",
            "sourceStatuses": [
                {
                    "resource": "vpc-1234567890abcdef0",
                    "status": "NOT_COLLECTING"
                }
            ]
        },
        {
            "account": "123456789012",
            "sourceName": "LAMBDA_EXECUTION",
            "sourceStatuses": [
                {
                    "resource": "vpc-1234567890abcdef0",
                    "status": "COLLECTING"
                }
… 25 more lines

For more information, see Collecting data from AWS services in the Amazon Security Lake User Guide.

Options

3 in the AWS CLI reference

--accountsThe Amazon Web Services account ID for which a static snapshot of the current Amazon Web Services Region, including enabled accounts and log sources, is retrieved.

--max-resultsThe maximum limit of accounts for which the static snapshot of the current Region, including enabled accounts and log sources, is retrieved.

--next-tokenLists if there are more results available.