Skip to content
AWS for Query.Farm

aws.securitylake.get_subscriber

Example SQL Queries

SELECT * FROM
aws.securitylake.get_subscriber
WHERE
"subscriber_id" = 'VALUE';

Description

Retrieves the subscription information for the specified subscription ID. You can get information about a specific subscriber.

Table Definition

Column NameColumn Data Type
subscriber_id Required Input Column

A value created by Amazon Security Lake that uniquely identifies your GetSubscriber API request.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
subscriber

The subscriber information for the specified subscriber ID.

STRUCT(
    "access_types" VARCHAR[],
    "created_at" TIMESTAMP_S,
    "resource_share_arn" VARCHAR,
    "resource_share_name" VARCHAR,
    "role_arn" VARCHAR,
    "s3_bucket_arn" VARCHAR,
    "sources" STRUCT(
        "aws_log_source" STRUCT(
            "source_name" VARCHAR,
            "source_version" VARCHAR
        ),
        "custom_log_source" STRUCT(
            "attributes" STRUCT(
                "crawler_arn" VARCHAR,
                "database_arn" VARCHAR,
                "table_arn" VARCHAR
            ),
            "provider" STRUCT(
                "location" VARCHAR,
                "role_arn" VARCHAR
            ),
            "source_name" VARCHAR,
            "source_version" VARCHAR
        )
    )[],
    "subscriber_arn" VARCHAR,
    "subscriber_description" VARCHAR,
    "subscriber_endpoint" VARCHAR,
    "subscriber_id" VARCHAR,
    "subscriber_identity" STRUCT(
        "external_id" VARCHAR,
        "principal" VARCHAR
    ),
    "subscriber_name" VARCHAR,
    "subscriber_status" VARCHAR,
    "updated_at" TIMESTAMP_S
)
Show child fields
subscriber.access_types[]
subscriber.created_at

The date and time when the subscriber was created.

subscriber.resource_share_arn

The Amazon Resource Name (ARN) which uniquely defines the Amazon Web Services RAM resource share. Before accepting the RAM resource share invitation, you can view details related to the RAM resource share.

This field is available only for Lake Formation subscribers created after March 8, 2023.

subscriber.resource_share_name

The name of the resource share.

subscriber.role_arn

The Amazon Resource Name (ARN) specifying the role of the subscriber.

subscriber.s3_bucket_arn

The ARN for the Amazon S3 bucket.

subscriber.sources[]
Show child fields
subscriber.sources[].aws_log_source

Amazon Security Lake supports log and event collection for natively supported Amazon Web Services. For more information, see the Amazon Security Lake User Guide.

Show child fields
subscriber.sources[].aws_log_source.source_name

The name for a Amazon Web Services source. This must be a Regionally unique value.

subscriber.sources[].aws_log_source.source_version

The version for a Amazon Web Services source. This must be a Regionally unique value.

subscriber.sources[].custom_log_source

Amazon Security Lake supports custom source types. For more information, see the Amazon Security Lake User Guide.

Show child fields
subscriber.sources[].custom_log_source.attributes

The attributes of a third-party custom source.

Show child fields
subscriber.sources[].custom_log_source.attributes.crawler_arn

The ARN of the Glue crawler.

subscriber.sources[].custom_log_source.attributes.database_arn

The ARN of the Glue database where results are written, such as: arn:aws:daylight:us-east-1::database/sometable/*.

subscriber.sources[].custom_log_source.attributes.table_arn

The ARN of the Glue table.

subscriber.sources[].custom_log_source.provider

The details of the log provider for a third-party custom source.

Show child fields
subscriber.sources[].custom_log_source.provider.location

The location of the partition in the Amazon S3 bucket for Security Lake.

subscriber.sources[].custom_log_source.provider.role_arn

The ARN of the IAM role to be used by the entity putting logs into your custom source partition. Security Lake will apply the correct access policies to this role, but you must first manually create the trust policy for this role. The IAM role name must start with the text 'Security Lake'. The IAM role must trust the logProviderAccountId to assume the role.

subscriber.sources[].custom_log_source.source_name

The name for a third-party custom source. This must be a Regionally unique value.

subscriber.sources[].custom_log_source.source_version

The version for a third-party custom source. This must be a Regionally unique value.

subscriber.subscriber_arn

The subscriber ARN of the Amazon Security Lake subscriber account.

subscriber.subscriber_description

The subscriber descriptions for a subscriber account. The description for a subscriber includes subscriberName, accountID, externalID, and subscriberId.

subscriber.subscriber_endpoint

The subscriber endpoint to which exception messages are posted.

subscriber.subscriber_id

The subscriber ID of the Amazon Security Lake subscriber account.

subscriber.subscriber_identity

The Amazon Web Services identity used to access your data.

Show child fields
subscriber.subscriber_identity.external_id

The external ID used to estalish trust relationship with the AWS identity.

subscriber.subscriber_identity.principal

The AWS identity principal.

subscriber.subscriber_name

The name of your Amazon Security Lake subscriber account.

subscriber.subscriber_status

The subscriber status of the Amazon Security Lake subscriber account.

subscriber.updated_at

The date and time when the subscriber was last updated.