subscriber_notifications

Creates, updates, deletes or gets a subscriber_notification resource or lists subscriber_notifications in a region

Overview

Name	subscriber_notifications
Type	Resource
Description	Resource Type definition for AWS::SecurityLake::SubscriberNotification
Id	awscc.securitylake.subscriber_notifications

Fields

get (all properties)

Name	Datatype	Description
▶notification_configuration	object
subscriber_arn	string	The ARN for the subscriber
subscriber_endpoint	string	The endpoint the subscriber should listen to for notifications
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
subscriber_arn	string	The ARN for the subscriber
region	string	AWS region.

For more information, see AWS::SecurityLake::SubscriberNotification.

Methods

Name	Resource	Accessible by	Required Params
create_resource	subscriber_notifications	INSERT	SubscriberArn, NotificationConfiguration, region
delete_resource	subscriber_notifications	DELETE	Identifier, region
update_resource	subscriber_notifications	UPDATE	Identifier, PatchDocument, region
list_resources	subscriber_notifications_list_only	SELECT	region
get_resource	subscriber_notifications	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual subscriber_notification.

SELECT
  region,
  notification_configuration,
  subscriber_arn,
  subscriber_endpoint
FROM awscc.securitylake.subscriber_notifications
WHERE
  region = 'us-east-1' AND
  Identifier = '{{ subscriber_arn }}';

list (identifiers only)

Lists all subscriber_notifications in a region.

SELECT
  region,
  subscriber_arn
FROM awscc.securitylake.subscriber_notifications_list_only
WHERE
  region = 'us-east-1';

INSERT example

Use the following StackQL query and manifest file to create a new subscriber_notification resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.securitylake.subscriber_notifications (
  NotificationConfiguration,
  SubscriberArn,
  region
)
SELECT
  '{{ notification_configuration }}',
  '{{ subscriber_arn }}',
  '{{ region }}';

All Properties

/*+ create */
INSERT INTO awscc.securitylake.subscriber_notifications (
  NotificationConfiguration,
  SubscriberArn,
  region
)
SELECT
  '{{ notification_configuration }}',
  '{{ subscriber_arn }}',
  '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: subscriber_notification
    props:
      - name: notification_configuration
        value:
          https_notification_configuration:
            authorization_api_key_name: '{{ authorization_api_key_name }}'
            authorization_api_key_value: '{{ authorization_api_key_value }}'
            endpoint: '{{ endpoint }}'
            http_method: '{{ http_method }}'
            target_role_arn: '{{ target_role_arn }}'
          sqs_notification_configuration: {}
      - name: subscriber_arn
        value: '{{ subscriber_arn }}'

UPDATE example

Use the following StackQL query and manifest file to update a subscriber_notification resource, using stack-deploy.

/*+ update */
UPDATE awscc.securitylake.subscriber_notifications
SET PatchDocument = string('{{ {
    "NotificationConfiguration": notification_configuration
} | generate_patch_document }}')
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ subscriber_arn }}';

DELETE example

/*+ delete */
DELETE FROM awscc.securitylake.subscriber_notifications
WHERE
  Identifier = '{{ subscriber_arn }}' AND
  region = 'us-east-1';

Permissions

To operate on the subscriber_notifications resource, the following permissions are required:

Create

securitylake:CreateDataLake,
securitylake:CreateSubscriber,
securitylake:CreateSubscriberNotification,
securitylake:GetSubscriber,
iam:CreateServiceLinkedRole,
iam:PutRolePolicy,
iam:DeleteRolePolicy,
iam:PassRole,
s3:PutBucketNotification,
s3:GetBucketNotification,
events:CreateApiDestination,
events:CreateConnection,
events:CreateRule,
events:UpdateConnection,
events:DeleteConnection,
events:UpdateApiDestination,
events:DeleteApiDestination,
events:ListApiDestinations,
events:ListConnections,
events:PutRule,
events:DescribeRule,
events:DeleteRule,
events:PutTargets,
events:RemoveTargets,
events:ListTargetsByRule,
secretsmanager:CreateSecret,
sqs:CreateQueue,
sqs:GetQueueAttributes,
sqs:GetQueueUrl,
sqs:SetQueueAttributes

Read

securitylake:GetSubscriber

Update

securitylake:UpdateSubscriberNotification,
securitylake:GetSubscriber,
iam:CreateServiceLinkedRole,
iam:PutRolePolicy,
iam:DeleteRolePolicy,
iam:PassRole,
events:CreateApiDestination,
events:CreateConnection,
events:UpdateConnection,
events:DeleteConnection,
events:UpdateApiDestination,
events:DeleteApiDestination,
events:DeleteRule,
events:ListApiDestinations,
events:ListConnections,
events:PutRule,
events:DescribeRule,
events:DeleteRule,
events:PutTargets,
events:RemoveTargets,
events:ListTargetsByRule,
secretsmanager:CreateSecret,
s3:GetBucketNotificationConfiguration,
s3:PutBucketNotificationConfiguration,
s3:PutBucketNotification,
s3:GetBucketNotification,
sqs:CreateQueue,
sqs:DeleteQueue,
sqs:GetQueueAttributes,
sqs:SetQueueAttributes

Delete

securitylake:DeleteSubscriberNotification,
securitylake:GetSubscriber,
iam:DeleteRole,
iam:DeleteRolePolicy,
events:DeleteApiDestination,
events:DeleteConnection,
events:DeleteRule,
events:ListTargetsByRule,
events:DescribeRule,
events:RemoveTargets,
sqs:DeleteQueue

List

securitylake:ListSubscribers