Skip to content

Commit dd29c1b

Browse files
SmoothexSmoothex
committed
Introduce AthenaQueryPolicy_v2
1 parent 04ab7c8 commit dd29c1b

5 files changed

Lines changed: 379 additions & 0 deletions

File tree

‎samtranslator/policy_templates_data/policy_templates.json‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,101 @@
170170
}
171171
}
172172
},
173+
"AthenaQueryPolicy_v2": {
174+
"Definition": {
175+
"Statement": [
176+
{
177+
"Action": [
178+
"athena:ListWorkGroups",
179+
"athena:GetWorkGroup",
180+
"athena:GetExecutionEngines",
181+
"athena:GetDatabase",
182+
"athena:ListDataCatalogs",
183+
"athena:ListDatabases",
184+
"athena:ListTableMetadata",
185+
"athena:GetTableMetadata"
186+
],
187+
"Effect": "Allow",
188+
"Resource": "*"
189+
},
190+
{
191+
"Action": [
192+
"glue:GetDatabases",
193+
"glue:GetDatabase",
194+
"glue:GetTables",
195+
"glue:GetTable"
196+
],
197+
"Effect": "Allow",
198+
"Resource": [
199+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog",
200+
{
201+
"Fn::Sub": [
202+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${databaseName}",
203+
{
204+
"databaseName": {
205+
"Ref": "DatabaseName"
206+
}
207+
}
208+
]
209+
},
210+
{
211+
"Fn::Sub": [
212+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${databaseName}/${tableName}",
213+
{
214+
"databaseName": {
215+
"Ref": "DatabaseName"
216+
},
217+
"tableName": {
218+
"Ref": "TableName"
219+
}
220+
}
221+
]
222+
}
223+
]
224+
},
225+
{
226+
"Action": [
227+
"athena:StartQueryExecution",
228+
"athena:GetQueryResults",
229+
"athena:DeleteNamedQuery",
230+
"athena:GetNamedQuery",
231+
"athena:ListQueryExecutions",
232+
"athena:StopQueryExecution",
233+
"athena:GetQueryResultsStream",
234+
"athena:ListNamedQueries",
235+
"athena:CreateNamedQuery",
236+
"athena:GetQueryExecution",
237+
"athena:BatchGetNamedQuery",
238+
"athena:BatchGetQueryExecution",
239+
"athena:GetWorkGroup"
240+
],
241+
"Effect": "Allow",
242+
"Resource": {
243+
"Fn::Sub": [
244+
"arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/${workgroupName}",
245+
{
246+
"workgroupName": {
247+
"Ref": "WorkGroupName"
248+
}
249+
}
250+
]
251+
}
252+
}
253+
]
254+
},
255+
"Description": "Gives permissions to execute Athena queries",
256+
"Parameters": {
257+
"DatabaseName": {
258+
"Description": "Name of the Glue Database"
259+
},
260+
"TableName": {
261+
"Description": "Name of the Glue Table"
262+
},
263+
"WorkGroupName": {
264+
"Description": "Name of the Athena Workgroup"
265+
}
266+
}
267+
},
173268
"CloudFormationDescribeStacksPolicy": {
174269
"Definition": {
175270
"Statement": [

‎tests/translator/input/all_policy_templates.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,11 @@ Resources:
160160
- AthenaQueryPolicy:
161161
WorkGroupName: name
162162

163+
- AthenaQueryPolicy_v2:
164+
WorkGroupName: name
165+
DatabaseName: name
166+
TableName: name
167+
163168
- S3WritePolicy:
164169
BucketName: name
165170

‎tests/translator/output/all_policy_templates.json‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1751,6 +1751,99 @@
17511751
]
17521752
},
17531753
"PolicyName": "KitchenSinkFunctionRolePolicy64"
1754+
},
1755+
{
1756+
"PolicyDocument": {
1757+
"Statement": [
1758+
{
1759+
"Action": [
1760+
"athena:ListWorkGroups",
1761+
"athena:GetWorkGroup",
1762+
"athena:GetExecutionEngines",
1763+
"athena:GetDatabase",
1764+
"athena:ListDataCatalogs",
1765+
"athena:ListDatabases",
1766+
"athena:ListTableMetadata",
1767+
"athena:GetTableMetadata"
1768+
],
1769+
"Effect": "Allow",
1770+
"Resource": "*"
1771+
},
1772+
{
1773+
"Action": [
1774+
"glue:GetDatabases",
1775+
"glue:GetDatabase",
1776+
"glue:GetTables",
1777+
"glue:GetTable"
1778+
],
1779+
"Effect": "Allow",
1780+
"Resource": [
1781+
{
1782+
"Fn::Sub": [
1783+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog",
1784+
{
1785+
"catalog": {
1786+
"Ref": "CatalogName"
1787+
}
1788+
}
1789+
]
1790+
},
1791+
{
1792+
"Fn::Sub": [
1793+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${databaseName}",
1794+
{
1795+
"databaseName": {
1796+
"Ref": "DatabaseName"
1797+
}
1798+
}
1799+
]
1800+
},
1801+
{
1802+
"Fn::Sub": [
1803+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${databaseName}/${tableName}",
1804+
{
1805+
"databaseName": {
1806+
"Ref": "DatabaseName"
1807+
},
1808+
"tableName": {
1809+
"Ref": "TableName"
1810+
}
1811+
}
1812+
]
1813+
}
1814+
]
1815+
},
1816+
{
1817+
"Action": [
1818+
"athena:StartQueryExecution",
1819+
"athena:GetQueryResults",
1820+
"athena:DeleteNamedQuery",
1821+
"athena:GetNamedQuery",
1822+
"athena:ListQueryExecutions",
1823+
"athena:StopQueryExecution",
1824+
"athena:GetQueryResultsStream",
1825+
"athena:ListNamedQueries",
1826+
"athena:CreateNamedQuery",
1827+
"athena:GetQueryExecution",
1828+
"athena:BatchGetNamedQuery",
1829+
"athena:BatchGetQueryExecution",
1830+
"athena:GetWorkGroup"
1831+
],
1832+
"Effect": "Allow",
1833+
"Resource": {
1834+
"Fn::Sub": [
1835+
"arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/${workgroupName}",
1836+
{
1837+
"workgroupName": {
1838+
"Ref": "WorkGroupName"
1839+
}
1840+
}
1841+
]
1842+
}
1843+
}
1844+
]
1845+
},
1846+
"PolicyName": "KitchenSinkFunctionRolePolicy65"
17541847
}
17551848
],
17561849
"Tags": [

‎tests/translator/output/aws-cn/all_policy_templates.json‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1751,6 +1751,99 @@
17511751
]
17521752
},
17531753
"PolicyName": "KitchenSinkFunctionRolePolicy64"
1754+
},
1755+
{
1756+
"PolicyDocument": {
1757+
"Statement": [
1758+
{
1759+
"Action": [
1760+
"athena:ListWorkGroups",
1761+
"athena:GetWorkGroup",
1762+
"athena:GetExecutionEngines",
1763+
"athena:GetDatabase",
1764+
"athena:ListDataCatalogs",
1765+
"athena:ListDatabases",
1766+
"athena:ListTableMetadata",
1767+
"athena:GetTableMetadata"
1768+
],
1769+
"Effect": "Allow",
1770+
"Resource": "*"
1771+
},
1772+
{
1773+
"Action": [
1774+
"glue:GetDatabases",
1775+
"glue:GetDatabase",
1776+
"glue:GetTables",
1777+
"glue:GetTable"
1778+
],
1779+
"Effect": "Allow",
1780+
"Resource": [
1781+
{
1782+
"Fn::Sub": [
1783+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog",
1784+
{
1785+
"catalog": {
1786+
"Ref": "CatalogName"
1787+
}
1788+
}
1789+
]
1790+
},
1791+
{
1792+
"Fn::Sub": [
1793+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${databaseName}",
1794+
{
1795+
"databaseName": {
1796+
"Ref": "DatabaseName"
1797+
}
1798+
}
1799+
]
1800+
},
1801+
{
1802+
"Fn::Sub": [
1803+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${databaseName}/${tableName}",
1804+
{
1805+
"databaseName": {
1806+
"Ref": "DatabaseName"
1807+
},
1808+
"tableName": {
1809+
"Ref": "TableName"
1810+
}
1811+
}
1812+
]
1813+
}
1814+
]
1815+
},
1816+
{
1817+
"Action": [
1818+
"athena:StartQueryExecution",
1819+
"athena:GetQueryResults",
1820+
"athena:DeleteNamedQuery",
1821+
"athena:GetNamedQuery",
1822+
"athena:ListQueryExecutions",
1823+
"athena:StopQueryExecution",
1824+
"athena:GetQueryResultsStream",
1825+
"athena:ListNamedQueries",
1826+
"athena:CreateNamedQuery",
1827+
"athena:GetQueryExecution",
1828+
"athena:BatchGetNamedQuery",
1829+
"athena:BatchGetQueryExecution",
1830+
"athena:GetWorkGroup"
1831+
],
1832+
"Effect": "Allow",
1833+
"Resource": {
1834+
"Fn::Sub": [
1835+
"arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/${workgroupName}",
1836+
{
1837+
"workgroupName": {
1838+
"Ref": "WorkGroupName"
1839+
}
1840+
}
1841+
]
1842+
}
1843+
}
1844+
]
1845+
},
1846+
"PolicyName": "KitchenSinkFunctionRolePolicy65"
17541847
}
17551848
],
17561849
"Tags": [

0 commit comments

Comments
 (0)