3

我想使用 Lake Formation 在我的 S3 / Glue Data Lake 之上设置一个额外的安全层。我想通过基础设施即代码尽可能多地做，所以我自然而然地查看了 Lake Formation 的CloudFormation 实现的文档，坦率地说，它目前非常无用。

我有一个简单的用例：在一个存储桶上向一个 IAM-User 授予管理员权限。有人可以帮我举个例子或类似的东西吗？

4

1 回答 1

2

这是我发现的：

目前可以设置数据湖位置并授予数据库数据权限。不幸的是，它似乎CloudFormation还不支持Data locations。您必须在 AWS 控制台中的 下手动授予您IAM Role对. 一旦支持更多，我会尽快更新答案。S3 BucketLake Formation -> Data locationsCloudFormation

这是我们目前使用的模板：

DataBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      AccessControl: Private
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Id: InfrequentAccessRule
            Status: Enabled
            Transitions:
              - TransitionInDays: 30
                StorageClass: INTELLIGENT_TIERING

GlueDatabase:
    Type: AWS::Glue::Database
    Properties:
      CatalogId: !Ref AWS::AccountId
      DatabaseInput:
        Name: !FindInMap [Environment, !Ref Environment, GlueDatabaseName]
        Description: !Sub Glue Database ${Environment}

GlueDataAccessRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: ''
            Effect: Allow
            Principal:
              Service: glue.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: AccessDataBucketPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - glue:*
                  - lakeformation:*
                Resource: '*'
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:ListBucket
                  - s3:DeleteObject
                Resource:
                  - !Sub ${DataBucket.Arn}
                  - !Sub ${DataBucket.Arn}/*

 DataBucketLakeFormation:
    Type: AWS::LakeFormation::Resource
    Properties:
      ResourceArn: !GetAtt DataBucket.Arn
      UseServiceLinkedRole: true

DataLakeFormationPermission:
    Type: AWS::LakeFormation::Permissions
    Properties:
      DataLakePrincipal:
        DataLakePrincipalIdentifier: !GetAtt GlueDataAccessRole.Arn
      Permissions:
        - ALL
      Resource:
        DatabaseResource:
          Name: !Ref GlueDatabase
        DataLocationResource:
          S3Resource: !Ref DataBucket
于 2021-03-31T12:44:16.443 回答