Skip to content

Commit b978b66

Browse files
SmoothexSmoothex
committed
introduce AthenaQueryPolicy_v2
1 parent d25eefb commit b978b66

File tree

5 files changed

+343
-1
lines changed

5 files changed

+343
-1
lines changed

‎samtranslator/policy_templates_data/policy_templates.json‎

Lines changed: 86 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,60 @@
117117
}
118118
},
119119
"AthenaQueryPolicy": {
120+
"Definition": {
121+
"Statement": [
122+
{
123+
"Action": [
124+
"athena:ListWorkGroups",
125+
"athena:GetExecutionEngine",
126+
"athena:GetExecutionEngines",
127+
"athena:GetNamespace",
128+
"athena:GetCatalogs",
129+
"athena:GetNamespaces",
130+
"athena:GetTables",
131+
"athena:GetTable"
132+
],
133+
"Effect": "Allow",
134+
"Resource": "*"
135+
},
136+
{
137+
"Action": [
138+
"athena:StartQueryExecution",
139+
"athena:GetQueryResults",
140+
"athena:DeleteNamedQuery",
141+
"athena:GetNamedQuery",
142+
"athena:ListQueryExecutions",
143+
"athena:StopQueryExecution",
144+
"athena:GetQueryResultsStream",
145+
"athena:ListNamedQueries",
146+
"athena:CreateNamedQuery",
147+
"athena:GetQueryExecution",
148+
"athena:BatchGetNamedQuery",
149+
"athena:BatchGetQueryExecution",
150+
"athena:GetWorkGroup"
151+
],
152+
"Effect": "Allow",
153+
"Resource": {
154+
"Fn::Sub": [
155+
"arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/${workgroupName}",
156+
{
157+
"workgroupName": {
158+
"Ref": "WorkGroupName"
159+
}
160+
}
161+
]
162+
}
163+
}
164+
]
165+
},
166+
"Description": "Gives permissions to execute Athena queries",
167+
"Parameters": {
168+
"WorkGroupName": {
169+
"Description": "Name of the Athena Workgroup"
170+
}
171+
}
172+
},
173+
"AthenaQueryPolicy_v2": {
120174
"Definition": {
121175
"Statement": [
122176
{
@@ -141,7 +195,32 @@
141195
"glue:GetTable"
142196
],
143197
"Effect": "Allow",
144-
"Resource": "*"
198+
"Resource": [
199+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog",
200+
{
201+
"Fn::Sub": [
202+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${databaseName}",
203+
{
204+
"databaseName": {
205+
"Ref": "DatabaseName"
206+
}
207+
}
208+
]
209+
},
210+
{
211+
"Fn::Sub": [
212+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${databaseName}/${tableName}",
213+
{
214+
"databaseName": {
215+
"Ref": "DatabaseName"
216+
},
217+
"tableName": {
218+
"Ref": "TableName"
219+
}
220+
}
221+
]
222+
}
223+
]
145224
},
146225
{
147226
"Action": [
@@ -177,6 +256,12 @@
177256
"Parameters": {
178257
"WorkGroupName": {
179258
"Description": "Name of the Athena Workgroup"
259+
},
260+
"DatabaseName": {
261+
"Description": "Name of the Athena Workgroup"
262+
},
263+
"TableName": {
264+
"Description": "Name of the Athena Workgroup"
180265
}
181266
}
182267
},

‎tests/translator/input/all_policy_templates.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,11 @@ Resources:
160160
- AthenaQueryPolicy:
161161
WorkGroupName: name
162162

163+
- AthenaQueryPolicy_v2:
164+
WorkGroupName: name
165+
DatabaseName: name
166+
TableName: name
167+
163168
- S3WritePolicy:
164169
BucketName: name
165170

‎tests/translator/output/all_policy_templates.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1751,6 +1751,90 @@
17511751
]
17521752
},
17531753
"PolicyName": "KitchenSinkFunctionRolePolicy64"
1754+
},
1755+
{
1756+
"PolicyDocument": {
1757+
"Statement": [
1758+
{
1759+
"Action": [
1760+
"athena:ListWorkGroups",
1761+
"athena:GetWorkGroup",
1762+
"athena:GetExecutionEngines",
1763+
"athena:GetDatabase",
1764+
"athena:ListDataCatalogs",
1765+
"athena:ListDatabases",
1766+
"athena:ListTableMetadata",
1767+
"athena:GetTableMetadata"
1768+
],
1769+
"Effect": "Allow",
1770+
"Resource": "*"
1771+
},
1772+
{
1773+
"Action": [
1774+
"glue:GetDatabases",
1775+
"glue:GetDatabase",
1776+
"glue:GetTables",
1777+
"glue:GetTable"
1778+
],
1779+
"Effect": "Allow",
1780+
"Resource": [
1781+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog",
1782+
{
1783+
"Fn::Sub": [
1784+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${databaseName}",
1785+
{
1786+
"databaseName": {
1787+
"Ref": "DatabaseName"
1788+
}
1789+
}
1790+
]
1791+
},
1792+
{
1793+
"Fn::Sub": [
1794+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${databaseName}/${tableName}",
1795+
{
1796+
"databaseName": {
1797+
"Ref": "DatabaseName"
1798+
},
1799+
"tableName": {
1800+
"Ref": "TableName"
1801+
}
1802+
}
1803+
]
1804+
}
1805+
]
1806+
},
1807+
{
1808+
"Action": [
1809+
"athena:StartQueryExecution",
1810+
"athena:GetQueryResults",
1811+
"athena:DeleteNamedQuery",
1812+
"athena:GetNamedQuery",
1813+
"athena:ListQueryExecutions",
1814+
"athena:StopQueryExecution",
1815+
"athena:GetQueryResultsStream",
1816+
"athena:ListNamedQueries",
1817+
"athena:CreateNamedQuery",
1818+
"athena:GetQueryExecution",
1819+
"athena:BatchGetNamedQuery",
1820+
"athena:BatchGetQueryExecution",
1821+
"athena:GetWorkGroup"
1822+
],
1823+
"Effect": "Allow",
1824+
"Resource": {
1825+
"Fn::Sub": [
1826+
"arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/${workgroupName}",
1827+
{
1828+
"workgroupName": {
1829+
"Ref": "WorkGroupName"
1830+
}
1831+
}
1832+
]
1833+
}
1834+
}
1835+
]
1836+
},
1837+
"PolicyName": "KitchenSinkFunctionRolePolicy65"
17541838
}
17551839
],
17561840
"Tags": [

‎tests/translator/output/aws-cn/all_policy_templates.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1751,6 +1751,90 @@
17511751
]
17521752
},
17531753
"PolicyName": "KitchenSinkFunctionRolePolicy64"
1754+
},
1755+
{
1756+
"PolicyDocument": {
1757+
"Statement": [
1758+
{
1759+
"Action": [
1760+
"athena:ListWorkGroups",
1761+
"athena:GetWorkGroup",
1762+
"athena:GetExecutionEngines",
1763+
"athena:GetDatabase",
1764+
"athena:ListDataCatalogs",
1765+
"athena:ListDatabases",
1766+
"athena:ListTableMetadata",
1767+
"athena:GetTableMetadata"
1768+
],
1769+
"Effect": "Allow",
1770+
"Resource": "*"
1771+
},
1772+
{
1773+
"Action": [
1774+
"glue:GetDatabases",
1775+
"glue:GetDatabase",
1776+
"glue:GetTables",
1777+
"glue:GetTable"
1778+
],
1779+
"Effect": "Allow",
1780+
"Resource": [
1781+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog",
1782+
{
1783+
"Fn::Sub": [
1784+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${databaseName}",
1785+
{
1786+
"databaseName": {
1787+
"Ref": "DatabaseName"
1788+
}
1789+
}
1790+
]
1791+
},
1792+
{
1793+
"Fn::Sub": [
1794+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${databaseName}/${tableName}",
1795+
{
1796+
"databaseName": {
1797+
"Ref": "DatabaseName"
1798+
},
1799+
"tableName": {
1800+
"Ref": "TableName"
1801+
}
1802+
}
1803+
]
1804+
}
1805+
]
1806+
},
1807+
{
1808+
"Action": [
1809+
"athena:StartQueryExecution",
1810+
"athena:GetQueryResults",
1811+
"athena:DeleteNamedQuery",
1812+
"athena:GetNamedQuery",
1813+
"athena:ListQueryExecutions",
1814+
"athena:StopQueryExecution",
1815+
"athena:GetQueryResultsStream",
1816+
"athena:ListNamedQueries",
1817+
"athena:CreateNamedQuery",
1818+
"athena:GetQueryExecution",
1819+
"athena:BatchGetNamedQuery",
1820+
"athena:BatchGetQueryExecution",
1821+
"athena:GetWorkGroup"
1822+
],
1823+
"Effect": "Allow",
1824+
"Resource": {
1825+
"Fn::Sub": [
1826+
"arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/${workgroupName}",
1827+
{
1828+
"workgroupName": {
1829+
"Ref": "WorkGroupName"
1830+
}
1831+
}
1832+
]
1833+
}
1834+
}
1835+
]
1836+
},
1837+
"PolicyName": "KitchenSinkFunctionRolePolicy65"
17541838
}
17551839
],
17561840
"Tags": [

‎tests/translator/output/aws-us-gov/all_policy_templates.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1751,6 +1751,90 @@
17511751
]
17521752
},
17531753
"PolicyName": "KitchenSinkFunctionRolePolicy64"
1754+
},
1755+
{
1756+
"PolicyDocument": {
1757+
"Statement": [
1758+
{
1759+
"Action": [
1760+
"athena:ListWorkGroups",
1761+
"athena:GetWorkGroup",
1762+
"athena:GetExecutionEngines",
1763+
"athena:GetDatabase",
1764+
"athena:ListDataCatalogs",
1765+
"athena:ListDatabases",
1766+
"athena:ListTableMetadata",
1767+
"athena:GetTableMetadata"
1768+
],
1769+
"Effect": "Allow",
1770+
"Resource": "*"
1771+
},
1772+
{
1773+
"Action": [
1774+
"glue:GetDatabases",
1775+
"glue:GetDatabase",
1776+
"glue:GetTables",
1777+
"glue:GetTable"
1778+
],
1779+
"Effect": "Allow",
1780+
"Resource": [
1781+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog",
1782+
{
1783+
"Fn::Sub": [
1784+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${databaseName}",
1785+
{
1786+
"databaseName": {
1787+
"Ref": "DatabaseName"
1788+
}
1789+
}
1790+
]
1791+
},
1792+
{
1793+
"Fn::Sub": [
1794+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${databaseName}/${tableName}",
1795+
{
1796+
"databaseName": {
1797+
"Ref": "DatabaseName"
1798+
},
1799+
"tableName": {
1800+
"Ref": "TableName"
1801+
}
1802+
}
1803+
]
1804+
}
1805+
]
1806+
},
1807+
{
1808+
"Action": [
1809+
"athena:StartQueryExecution",
1810+
"athena:GetQueryResults",
1811+
"athena:DeleteNamedQuery",
1812+
"athena:GetNamedQuery",
1813+
"athena:ListQueryExecutions",
1814+
"athena:StopQueryExecution",
1815+
"athena:GetQueryResultsStream",
1816+
"athena:ListNamedQueries",
1817+
"athena:CreateNamedQuery",
1818+
"athena:GetQueryExecution",
1819+
"athena:BatchGetNamedQuery",
1820+
"athena:BatchGetQueryExecution",
1821+
"athena:GetWorkGroup"
1822+
],
1823+
"Effect": "Allow",
1824+
"Resource": {
1825+
"Fn::Sub": [
1826+
"arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/${workgroupName}",
1827+
{
1828+
"workgroupName": {
1829+
"Ref": "WorkGroupName"
1830+
}
1831+
}
1832+
]
1833+
}
1834+
}
1835+
]
1836+
},
1837+
"PolicyName": "KitchenSinkFunctionRolePolicy65"
17541838
}
17551839
],
17561840
"Tags": [

0 commit comments

Comments
 (0)