{"id":20741,"date":"2022-11-30T03:00:42","date_gmt":"2022-11-30T02:00:42","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/?p=20741"},"modified":"2023-02-27T12:08:20","modified_gmt":"2023-02-27T11:08:20","slug":"aws-reinvent-day-2-all-about-lakes","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/","title":{"rendered":"AWS re:Invent day 2: All about Lakes"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

As usual the day 2 with Adams Selipsky’s keynote is where most announcements are done…and they have been severals. As you will probably see plenty of articles about these, and by the way I recommend you to take few minutes for the one of @nicolas-jardot, on my hand I will focus on auditing and compliance by showing how you can leverage the power of Lakes in AWS to improve you governance.<\/p>\n\n\n\n

Overloaded of CloudTrail events? try out CloudTrail Lake<\/h2>\n\n\n\n

I guess we all agree that auditing what is happening on your cloud tenant and monitoring compliance isn’t a question anymore. Whatever if it is in a proactive effort to keep everything under control or reactive to find out who screwed up your budget \ud83d\ude09<\/p>\n\n\n\n

Then activating and CloudTrail is a must. Indeed if you deployed your cloud organization and landscape using AWS Control Tower, CloudTrail has been already activated in background.
However, that was the easiest part. The challenge usually comes when you have to access and analyse the outputs stored in S3.<\/p>\n\n\n\n

A pretty good solution I had the opportunity to test in a 2 hours workshop is to move then to an Event Data Store and activating CloudTrail Lake allowing to aggregate events from multiple regions and accounts.<\/p>\n\n\n\n

The principle is store store all or selected events\/outputs in a central repository and then to be able to query these data directly with SQL statements. The output return can be exported to S3 and for instance provided to external auditors.<\/p>\n\n\n\n

Activating CloudTrail Lake<\/h3>\n\n\n\n

Using CloudTrail Lake you will be starting by creating an Event Data Store, which supports 2 type of data: CloudTrail events and Configuration items coming from AWS Config.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

By default you will trace all management events coming from both the console and the API, which you can also customize.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Beside you can check the Data events option, allowing you to log operations performs on and within resources. For instance activities which took place on an S3 bucket. It even allows you to set filtering parameters to define which resources you will be tracing or not.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Getting the outputs…<\/h3>\n\n\n\n

Here comes the interesting part. Using CloudTrail Lake you will be able to run queries against the events stored in your lake. You can either use some sample queries provided by AWS…<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

…or write your own queries in the query editor<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Pretty basic as it is based on a standard SQL structure:<\/p>\n\n\n\n

SELECT <columns> FROM <table> WHERE <conditions><\/code><\/pre>\n\n\n\n
where the table is your Event data store ID.<\/p>\n\n\n\n
The output is by default presented in a table directly below your query but can also be saved to S3<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
As you can see the output of some data like here the additionalEventData is in JSON format. This means that we can extend our SQL statement to clean it up a bit as well as filtering it out a bit more.<\/p>\n\n\n\n
Here an example a bit more funny with some JSON data extraction and additional filtering on AWS Config rules.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Amazon Security Lake<\/h2>\n\n\n\n
Finally I would like to conclude this post by coming back on of the announcements made today: Amazon Security Lake.<\/p>\n\n\n\n
Basically the principle is pretty similar to CloudTrail Lake in the sense of offering a central location for your security data. It works also cross regions and accounts…but in addition it also allows the integration of third party sources in order to even aggregate for instance data for on-prem environments.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
This works as Security Lake as adopted the Open Cybersecurity Schema Framework (OCSF).<\/p>\n\n\n\n
For moment this new feature is in preview mode and available only in 7 regions…but for sure something my Security Officer will be looking for playing with \ud83d\ude09<\/p>\n","protected":false},"excerpt":{"rendered":"
As usual the day 2 with Adams Selipsky’s keynote is where most announcements are done…and they have been severals. As you will probably see plenty of articles about these, and by the way I recommend you to take few minutes for the one of @nicolas-jardot, on my hand I will focus on auditing and compliance […]<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1865,955],"tags":[1042,133,135,2564],"type_dbi":[],"class_list":["post-20741","post","type-post","status-publish","format-standard","hentry","category-aws","category-cloud","tag-auditing","tag-aws","tag-cloud","tag-security-3"],"acf":[],"yoast_head":"\nAWS re:Invent day 2: All about Lakes - dbi Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AWS re:Invent day 2: All about Lakes\" \/>\n<meta property=\"og:description\" content=\"As usual the day 2 with Adams Selipsky’s keynote is where most announcements are done…and they have been severals. As you will probably see plenty of articles about these, and by the way I recommend you to take few minutes for the one of @nicolas-jardot, on my hand I will focus on auditing and compliance […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2022-11-30T02:00:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-02-27T11:08:20+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/11\/IMG_5352-1024x505.png\" \/>\n<meta name=\"author\" content=\"David Hueber\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"David Hueber\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/\"},\"author\":{\"name\":\"David Hueber\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/8873e20a98a02305870909f4e3d0088f\"},\"headline\":\"AWS re:Invent day 2: All about Lakes\",\"datePublished\":\"2022-11-30T02:00:42+00:00\",\"dateModified\":\"2023-02-27T11:08:20+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/\"},\"wordCount\":616,\"commentCount\":0,\"image\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/11\/IMG_5352-1024x505.png\",\"keywords\":[\"Auditing\",\"AWS\",\"Cloud\",\"Security\"],\"articleSection\":[\"AWS\",\"Cloud\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/\",\"name\":\"AWS re:Invent day 2: All about Lakes - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/11\/IMG_5352-1024x505.png\",\"datePublished\":\"2022-11-30T02:00:42+00:00\",\"dateModified\":\"2023-02-27T11:08:20+00:00\",\"author\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/8873e20a98a02305870909f4e3d0088f\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/#primaryimage\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/11\/IMG_5352.png\",\"contentUrl\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/11\/IMG_5352.png\",\"width\":1100,\"height\":543},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/www.dbi-services.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"AWS re:Invent day 2: All about Lakes\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/8873e20a98a02305870909f4e3d0088f\",\"name\":\"David Hueber\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/fc07284dbd5667f0bed32b0d8d64076ab885746973ea1b5c4e69c6fa7074cf59?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/fc07284dbd5667f0bed32b0d8d64076ab885746973ea1b5c4e69c6fa7074cf59?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/fc07284dbd5667f0bed32b0d8d64076ab885746973ea1b5c4e69c6fa7074cf59?s=96&d=mm&r=g\",\"caption\":\"David Hueber\"},\"description\":\"David Hueber has ten years of experience in infrastructure operation & management, engineering, and optimization. He is specialized in Oracle technologies (engineering, backup and recovery, high availability, etc.), Service Management standards and Oracle infrastructure operation processes (Service Desk, Change Management, Capacity Planning, etc.). David Hueber is ITILv3 Service Operation Lifecycle certified and Linux LPIC-1 certified. He received a university degree in Informatics and Networks at the IUT Mulhouse, France. He also studied Information Systems at the Conservatoire National des Arts et M\u00e9tiers in Mulhouse, France. His branch-related experience covers Financial Services \/ Banking, Chemicals & Pharmaceuticals, Transport & Logistics, Retail, Food, etc.\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/author\/david-hueber\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"AWS re:Invent day 2: All about Lakes - dbi Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/","og_locale":"en_US","og_type":"article","og_title":"AWS re:Invent day 2: All about Lakes","og_description":"As usual the day 2 with Adams Selipsky’s keynote is where most announcements are done…and they have been severals. As you will probably see plenty of articles about these, and by the way I recommend you to take few minutes for the one of @nicolas-jardot, on my hand I will focus on auditing and compliance […]","og_url":"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/","og_site_name":"dbi Blog","article_published_time":"2022-11-30T02:00:42+00:00","article_modified_time":"2023-02-27T11:08:20+00:00","og_image":[{"url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/11\/IMG_5352-1024x505.png","type":"","width":"","height":""}],"author":"David Hueber","twitter_card":"summary_large_image","twitter_misc":{"Written by":"David Hueber","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/"},"author":{"name":"David Hueber","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/8873e20a98a02305870909f4e3d0088f"},"headline":"AWS re:Invent day 2: All about Lakes","datePublished":"2022-11-30T02:00:42+00:00","dateModified":"2023-02-27T11:08:20+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/"},"wordCount":616,"commentCount":0,"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/11\/IMG_5352-1024x505.png","keywords":["Auditing","AWS","Cloud","Security"],"articleSection":["AWS","Cloud"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/","url":"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/","name":"AWS re:Invent day 2: All about Lakes - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/#primaryimage"},"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/11\/IMG_5352-1024x505.png","datePublished":"2022-11-30T02:00:42+00:00","dateModified":"2023-02-27T11:08:20+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/8873e20a98a02305870909f4e3d0088f"},"breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/#primaryimage","url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/11\/IMG_5352.png","contentUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/11\/IMG_5352.png","width":1100,"height":543},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/aws-reinvent-day-2-all-about-lakes\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"AWS re:Invent day 2: All about Lakes"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/8873e20a98a02305870909f4e3d0088f","name":"David Hueber","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/fc07284dbd5667f0bed32b0d8d64076ab885746973ea1b5c4e69c6fa7074cf59?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/fc07284dbd5667f0bed32b0d8d64076ab885746973ea1b5c4e69c6fa7074cf59?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/fc07284dbd5667f0bed32b0d8d64076ab885746973ea1b5c4e69c6fa7074cf59?s=96&d=mm&r=g","caption":"David Hueber"},"description":"David Hueber has ten years of experience in infrastructure operation & management, engineering, and optimization. He is specialized in Oracle technologies (engineering, backup and recovery, high availability, etc.), Service Management standards and Oracle infrastructure operation processes (Service Desk, Change Management, Capacity Planning, etc.). David Hueber is ITILv3 Service Operation Lifecycle certified and Linux LPIC-1 certified. He received a university degree in Informatics and Networks at the IUT Mulhouse, France. He also studied Information Systems at the Conservatoire National des Arts et M\u00e9tiers in Mulhouse, France. His branch-related experience covers Financial Services \/ Banking, Chemicals & Pharmaceuticals, Transport & Logistics, Retail, Food, etc.","url":"https:\/\/www.dbi-services.com\/blog\/author\/david-hueber\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/20741","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=20741"}],"version-history":[{"count":5,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/20741\/revisions"}],"predecessor-version":[{"id":20768,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/20741\/revisions\/20768"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=20741"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=20741"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=20741"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=20741"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}