amazon-web-services - 将 AWS Lake Formation 与 CloudFormation 结合使用

Question

我想在 S3/Glue 数据湖之上设置额外的安全层使用湖泊形成。我想通过基础设施即代码做尽可能多的事情，所以很自然地我查看了 CloudFormation implementation 的文档Lake Formation 的数据，坦率地说，目前非常无用。

我有一个简单的用例:向一个存储桶上的一个 IAM 用户授予管理员权限。有人可以帮我举个例子或类似的东西吗？

Answer 1

这是我发现的:

目前可以设置数据湖位置并向数据库授予数据权限。不幸的是，CloudFormation 似乎还不支持数据位置。您必须在 AWS 控制台中的 Lake Formation -> 数据位置 下手动授予您的 IAM 角色 对 S3 存储桶 的访问权限。一旦 CloudFormation 支持更多功能，我将立即更新答案。

这是我们目前正在使用的模板:

DataBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      AccessControl: Private
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Id: InfrequentAccessRule
            Status: Enabled
            Transitions:
              - TransitionInDays: 30
                StorageClass: INTELLIGENT_TIERING

GlueDatabase:
    Type: AWS::Glue::Database
    Properties:
      CatalogId: !Ref AWS::AccountId
      DatabaseInput:
        Name: !FindInMap [Environment, !Ref Environment, GlueDatabaseName]
        Description: !Sub Glue Database ${Environment}

GlueDataAccessRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: ''
            Effect: Allow
            Principal:
              Service: glue.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: AccessDataBucketPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - glue:*
                  - lakeformation:*
                Resource: '*'
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:ListBucket
                  - s3:DeleteObject
                Resource:
                  - !Sub ${DataBucket.Arn}
                  - !Sub ${DataBucket.Arn}/*

 DataBucketLakeFormation:
    Type: AWS::LakeFormation::Resource
    Properties:
      ResourceArn: !GetAtt DataBucket.Arn
      UseServiceLinkedRole: true

DataLakeFormationPermission:
    Type: AWS::LakeFormation::Permissions
    Properties:
      DataLakePrincipal:
        DataLakePrincipalIdentifier: !GetAtt GlueDataAccessRole.Arn
      Permissions:
        - ALL
      Resource:
        DatabaseResource:
          Name: !Ref GlueDatabase
        DataLocationResource:
          S3Resource: !Ref DataBucket