Manage Access Audits¶

The AWS Lake Formation connector provides access auditing capabilities to help organizations track user activity, ensure compliance, and enhance security monitoring. This feature enables you to collect and analyze audit logs from AWS CloudTrail to monitor access to Lake Formation resources.

Prerequisites¶

Steps to Enable Audit Logs¶

Step 1: Create Trail in AWS CloudTrail¶

1. Go to AWS CloudTrail service → Dashboard.

2. Click Create Trail.

3. On the General Details page, provide the Trail name (such as LF_Cloud_Trail) of your choice.

4. Provide the S3 storage location of your S3 bucket.

   Make note of the S3 bucket location

   Make note of the S3 bucket location for CloudTrail logs. For example, lf-dev-bucket/AWSLogs/123456789012.

5. Uncheck the Log file SSE-KMS encryption and Log file validation checkboxes.

6. Click Next.

7. On the page that appears, under Choose Log Events enable the checkbox for Management Events. Keep the checkboxes for Read and Write as checked.

8. Enable the checkbox for Data Events. Then scroll down to Data Events section, select the Data Event type as AWS Lake Formation and Log Selector template as Log All Events.

9. Click Next.

10. Confirm the values and click Create Trail.

Step 2: Create Database and Table for Storing Audit Logs Query Results¶

Use AWS Athena to create a database and table for storing audit logs query results.

2.1 Create Database¶

1

CREATE DATABASE lf_audit_db;

2.2 Create Table¶

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

CREATE EXTERNAL TABLE lf_audit_db.cloudtrail_logs (
    eventVersion STRING,
    userIdentity STRUCT<
        type: STRING,
        principalId: STRING,
        arn: STRING,
        accountId: STRING,
        invokedBy: STRING,
        accessKeyId: STRING,
        userName: STRING,
        sessionContext: STRUCT<
            attributes: STRUCT<
                mfaAuthenticated: STRING,
                creationDate: STRING>,
            sessionIssuer: STRUCT<
                type: STRING,
                principalId: STRING,
                arn: STRING,
                accountId: STRING,
                userName: STRING>>>
    >,
    eventTime STRING,
    eventSource STRING,
    eventName STRING,
    awsRegion STRING,
    sourceIpAddress STRING,
    userAgent STRING,
    errorCode STRING,
    errorMessage STRING,
    requestParameters STRING,
    responseElements STRING,
    additionalEventData STRING,
    requestId STRING,
    eventId STRING,
    resources ARRAY<STRUCT<
        arn: STRING,
        accountId: STRING,
        type: STRING>>,
    eventType STRING,
    apiVersion STRING,
    readOnly STRING,
    recipientAccountId STRING,
    serviceEventDetails STRING,
    sharedEventID STRING,
    vpcEndpointId STRING
)
COMMENT 'CloudTrail table for lakeformation audit logs'
ROW FORMAT SERDE 'com.amazon.emr.hive.serde.CloudTrailSerde'
STORED AS INPUTFORMAT 'com.amazon.emr.cloudtrail.CloudTrailInputFormat'
OUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'
LOCATION 's3://<S3_LAKE_FORMATION_AUDITS_BUCKET>/AWSLogs/<OBJECT_PATH>'
TBLPROPERTIES ('classification'='cloudtrail');

Step 3: Configure IAM Policy for Reading Access Audits¶

Configuration Properties¶

The following table describes all configuration properties for managing access audits in the Lake Formation connector:

Setup¶

Limitations¶

Omitted Query Strings in Lake Formation Access Audits¶

Access audit logs generated by Lake Formation cannot retrieve SQL queries executed by users. AWS has replaced actual query strings with ***OMITTED*** in these log files. Thus, Privacera displays ***OMITTED*** query strings in its UI as part of access audits.

For more information, see Understanding Athena log file entries in the AWS documentation.