observability: Amazon Security Lake OCSF custom source with Security Hub and Detective (Phase 6, optional)

[ausbru87]

Summary

Phase 6 (optional, compliance-grade). Normalize Coder audit events to OCSF and
land them in Amazon Security Lake, then enable Security Hub and Detective for
findings and investigation. Design: docs/plans/observability-aws-native.md.

Background and caveats

Security Lake and Detective APIs are available (verified read-only), but Security
Hub is not subscribed (securityhub describe-hub returns InvalidAccessException: not subscribed) and Detective has no graph yet. These must be enabled first.
This path is heavier than the Firehose to S3 to Athena archive and should be
adopted only if OCSF normalization and Security Hub/Detective are required.

Tasks

• Enable Amazon Security Lake in us-gov-west-1 and choose the rollup and
  storage configuration.
• Register Coder as a Security Lake custom source.
• Author and maintain the Coder to OCSF mapping (for example Authentication,
  Account Change, and API Activity classes) via a Glue or Lambda transform from
  the audit JSON.
• Subscribe Security Hub and Detective, and validate query access (Athena or
  a Security Lake subscriber).

Acceptance criteria

• Coder audit events appear as OCSF records in Security Lake.
• A subscriber (Athena or Security Hub) can query normalized Coder events.

Notes

• Confirm GovCloud feature parity for Security Lake, Security Hub, and Detective
  before committing; mark any gaps discovered during build.

Generated by Coder Agents.