Feature/aws securitylake subscriber

.changelog/35981.txt

@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_securitylake_subscriber
+```

internal/service/securitylake/data_lake_test.go

@@ -345,7 +345,7 @@ data "aws_caller_identity" "current" {}
 data "aws_partition" "current" {}
 
 resource "aws_iam_role" "meta_store_manager" {
-  name               = "AmazonSecurityLakeMetaStoreManager"
+  name               = "AmazonSecurityLakeMetaStoreManagerV2"
   path               = "/service-role/"
   assume_role_policy = <<POLICY
 {
@@ -364,58 +364,9 @@ resource "aws_iam_role" "meta_store_manager" {
 POLICY
 }
 
-resource "aws_iam_role_policy" "meta_store_manager" {
-  name = "AmazonSecurityLakeMetaStoreManagerPolicy"
-  role = aws_iam_role.meta_store_manager.name
-
-  policy = <<POLICY
-{
-  "Version": "2012-10-17",
-  "Statement": [{
-    "Sid": "AllowWriteLambdaLogs",
-    "Effect": "Allow",
-    "Action": [
-      "logs:CreateLogStream",
-      "logs:PutLogEvents"
-    ],
-    "Resource": [
-      "arn:${data.aws_partition.current.partition}:logs:*:${data.aws_caller_identity.current.account_id}:log-group:/aws/lambda/SecurityLake_Glue_Partition_Updater_Lambda*"
-    ]
-  }, {
-    "Sid": "AllowCreateAwsCloudWatchLogGroup",
-    "Effect": "Allow",
-    "Action": [
-      "logs:CreateLogGroup"
-    ],
-    "Resource": [
-      "arn:${data.aws_partition.current.partition}:logs:*:${data.aws_caller_identity.current.account_id}:/aws/lambda/SecurityLake_Glue_Partition_Updater_Lambda*"
-    ]
-  }, {
-    "Sid": "AllowGlueManage",
-    "Effect": "Allow",
-    "Action": [
-      "glue:CreatePartition",
-      "glue:BatchCreatePartition"
-    ],
-    "Resource": [
-      "arn:${data.aws_partition.current.partition}:glue:*:*:table/amazon_security_lake_glue_db*/*",
-      "arn:${data.aws_partition.current.partition}:glue:*:*:database/amazon_security_lake_glue_db*",
-      "arn:${data.aws_partition.current.partition}:glue:*:*:catalog"
-    ]
-  }, {
-    "Sid": "AllowToReadFromSqs",
-    "Effect": "Allow",
-    "Action": [
-      "sqs:ReceiveMessage",
-      "sqs:DeleteMessage",
-      "sqs:GetQueueAttributes"
-    ],
-    "Resource": [
-      "arn:${data.aws_partition.current.partition}:sqs:*:${data.aws_caller_identity.current.account_id}:SecurityLake*"
-    ]
-  }]
-}
-POLICY
+resource "aws_iam_role_policy_attachment" "datalake" {
+  role       = aws_iam_role.meta_store_manager.name
+  policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AmazonSecurityLakeMetastoreManager"
 }
 
 resource "aws_iam_role" "datalake_s3_replication" {

internal/service/securitylake/exports_test.go

@@ -8,8 +8,10 @@ var (
 	ResourceAWSLogSource    = newAWSLogSourceResource
 	ResourceCustomLogSource = newCustomLogSourceResource
 	ResourceDataLake        = newDataLakeResource
+	ResourceSubscriber      = newSubscriberResource
 
 	FindAWSLogSourceBySourceName    = findAWSLogSourceBySourceName
 	FindCustomLogSourceBySourceName = findCustomLogSourceBySourceName
 	FindDataLakeByARN               = findDataLakeByARN
+	FindSubscriberByID              = findSubscriberByID
 )

internal/service/securitylake/securitylake_test.go

@@ -30,6 +30,13 @@ func TestAccSecurityLake_serial(t *testing.T) {
 			"lifecycleUpdate": testAccDataLake_lifeCycleUpdate,
 			"replication":     testAccDataLake_replication,
 		},
+		"Subscriber": {
+			"basic":      testAccSubscriber_basic,
+			"customLogs": testAccSubscriber_customLogSource,
+			"disappears": testAccSubscriber_disappears,
+			"tags":       testAccSubscriber_tags,
+			"updated":    testAccSubscriber_update,
+		},
 	}
 
 	acctest.RunSerialTests2Levels(t, testCases, 0)