Question

我想在我的 S3/Glue 数据湖之上设置一个额外的安全层使用 Lake Formation。我想通过基础设施即代码做尽可能多的事情，所以很自然地我查看了 Lake Formation CloudFormation implementation 的文档，坦率地说，它目前非常无用。

我有一个简单的用例：在一个存储桶上向一个 IAM 用户授予管理员权限。有人可以帮我举个例子或类似的东西吗？

Answer 1

这是我发现的：

目前可以设置数据湖位置并向您的数据库授予数据权限。不幸的是，CloudFormation 似乎还不支持 Data locations。您必须在 AWS 控制台中的 IAM Role 下手动授予您对 S3 Bucket 的 Lake Formation -> Data locations 访问权限。 CloudFormation 支持更多内容后，我会尽快更新答案。

这是我们目前使用的模板：

DataBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      AccessControl: Private
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Id: InfrequentAccessRule
            Status: Enabled
            Transitions:
              - TransitionInDays: 30
                StorageClass: INTELLIGENT_TIERING

GlueDatabase:
    Type: AWS::Glue::Database
    Properties:
      CatalogId: !Ref AWS::AccountId
      DatabaseInput:
        Name: !FindInMap [Environment, !Ref Environment, GlueDatabaseName]
        Description: !Sub Glue Database ${Environment}

GlueDataAccessRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: ''
            Effect: Allow
            Principal:
              Service: glue.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: AccessDataBucketPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - glue:*
                  - lakeformation:*
                Resource: '*'
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:ListBucket
                  - s3:DeleteObject
                Resource:
                  - !Sub ${DataBucket.Arn}
                  - !Sub ${DataBucket.Arn}/*

 DataBucketLakeFormation:
    Type: AWS::LakeFormation::Resource
    Properties:
      ResourceArn: !GetAtt DataBucket.Arn
      UseServiceLinkedRole: true

DataLakeFormationPermission:
    Type: AWS::LakeFormation::Permissions
    Properties:
      DataLakePrincipal:
        DataLakePrincipalIdentifier: !GetAtt GlueDataAccessRole.Arn
      Permissions:
        - ALL
      Resource:
        DatabaseResource:
          Name: !Ref GlueDatabase
        DataLocationResource:
          S3Resource: !Ref DataBucket

将 AWS Lake Formation 与 CloudFormation 结合使用

1 个答案: