Skip to content

Commit 0585ac3

Browse files
SmoothexSmoothex
committed
Introduce AthenaQueryPolicy_v2
1 parent 0beb86e commit 0585ac3

File tree

5 files changed

+388
-0
lines changed

5 files changed

+388
-0
lines changed

‎samtranslator/policy_templates_data/policy_templates.json‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,110 @@
170170
}
171171
}
172172
},
173+
"AthenaQueryPolicy_v2": {
174+
"Definition": {
175+
"Statement": [
176+
{
177+
"Action": [
178+
"athena:ListWorkGroups",
179+
"athena:GetWorkGroup",
180+
"athena:GetExecutionEngines",
181+
"athena:GetDatabase",
182+
"athena:ListDataCatalogs",
183+
"athena:ListDatabases",
184+
"athena:ListTableMetadata",
185+
"athena:GetTableMetadata"
186+
],
187+
"Effect": "Allow",
188+
"Resource": "*"
189+
},
190+
{
191+
"Action": [
192+
"glue:GetDatabases",
193+
"glue:GetDatabase",
194+
"glue:GetTables",
195+
"glue:GetTable"
196+
],
197+
"Effect": "Allow",
198+
"Resource": [
199+
{
200+
"Fn::Sub": [
201+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog",
202+
{
203+
"catalog": {
204+
"Ref": "CatalogName"
205+
}
206+
}
207+
]
208+
},
209+
{
210+
"Fn::Sub": [
211+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${databaseName}",
212+
{
213+
"databaseName": {
214+
"Ref": "DatabaseName"
215+
}
216+
}
217+
]
218+
},
219+
{
220+
"Fn::Sub": [
221+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${databaseName}/${tableName}",
222+
{
223+
"databaseName": {
224+
"Ref": "DatabaseName"
225+
},
226+
"tableName": {
227+
"Ref": "TableName"
228+
}
229+
}
230+
]
231+
}
232+
]
233+
},
234+
{
235+
"Action": [
236+
"athena:StartQueryExecution",
237+
"athena:GetQueryResults",
238+
"athena:DeleteNamedQuery",
239+
"athena:GetNamedQuery",
240+
"athena:ListQueryExecutions",
241+
"athena:StopQueryExecution",
242+
"athena:GetQueryResultsStream",
243+
"athena:ListNamedQueries",
244+
"athena:CreateNamedQuery",
245+
"athena:GetQueryExecution",
246+
"athena:BatchGetNamedQuery",
247+
"athena:BatchGetQueryExecution",
248+
"athena:GetWorkGroup"
249+
],
250+
"Effect": "Allow",
251+
"Resource": {
252+
"Fn::Sub": [
253+
"arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/${workgroupName}",
254+
{
255+
"workgroupName": {
256+
"Ref": "WorkGroupName"
257+
}
258+
}
259+
]
260+
}
261+
}
262+
]
263+
},
264+
"Description": "Gives permissions to execute Athena queries",
265+
"Parameters": {
266+
"DatabaseName": {
267+
"Description": "Name of the Glue Database"
268+
},
269+
"TableName": {
270+
"Description": "Name of the Glue Table"
271+
},
272+
"WorkGroupName": {
273+
"Description": "Name of the Athena Workgroup"
274+
}
275+
}
276+
},
173277
"CloudFormationDescribeStacksPolicy": {
174278
"Definition": {
175279
"Statement": [

‎tests/translator/input/all_policy_templates.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,11 @@ Resources:
160160
- AthenaQueryPolicy:
161161
WorkGroupName: name
162162

163+
- AthenaQueryPolicy_v2:
164+
WorkGroupName: name
165+
DatabaseName: name
166+
TableName: name
167+
163168
- S3WritePolicy:
164169
BucketName: name
165170

‎tests/translator/output/all_policy_templates.json‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1751,6 +1751,99 @@
17511751
]
17521752
},
17531753
"PolicyName": "KitchenSinkFunctionRolePolicy64"
1754+
},
1755+
{
1756+
"PolicyDocument": {
1757+
"Statement": [
1758+
{
1759+
"Action": [
1760+
"athena:ListWorkGroups",
1761+
"athena:GetWorkGroup",
1762+
"athena:GetExecutionEngines",
1763+
"athena:GetDatabase",
1764+
"athena:ListDataCatalogs",
1765+
"athena:ListDatabases",
1766+
"athena:ListTableMetadata",
1767+
"athena:GetTableMetadata"
1768+
],
1769+
"Effect": "Allow",
1770+
"Resource": "*"
1771+
},
1772+
{
1773+
"Action": [
1774+
"glue:GetDatabases",
1775+
"glue:GetDatabase",
1776+
"glue:GetTables",
1777+
"glue:GetTable"
1778+
],
1779+
"Effect": "Allow",
1780+
"Resource": [
1781+
{
1782+
"Fn::Sub": [
1783+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog",
1784+
{
1785+
"catalog": {
1786+
"Ref": "CatalogName"
1787+
}
1788+
}
1789+
]
1790+
},
1791+
{
1792+
"Fn::Sub": [
1793+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${databaseName}",
1794+
{
1795+
"databaseName": {
1796+
"Ref": "DatabaseName"
1797+
}
1798+
}
1799+
]
1800+
},
1801+
{
1802+
"Fn::Sub": [
1803+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${databaseName}/${tableName}",
1804+
{
1805+
"databaseName": {
1806+
"Ref": "DatabaseName"
1807+
},
1808+
"tableName": {
1809+
"Ref": "TableName"
1810+
}
1811+
}
1812+
]
1813+
}
1814+
]
1815+
},
1816+
{
1817+
"Action": [
1818+
"athena:StartQueryExecution",
1819+
"athena:GetQueryResults",
1820+
"athena:DeleteNamedQuery",
1821+
"athena:GetNamedQuery",
1822+
"athena:ListQueryExecutions",
1823+
"athena:StopQueryExecution",
1824+
"athena:GetQueryResultsStream",
1825+
"athena:ListNamedQueries",
1826+
"athena:CreateNamedQuery",
1827+
"athena:GetQueryExecution",
1828+
"athena:BatchGetNamedQuery",
1829+
"athena:BatchGetQueryExecution",
1830+
"athena:GetWorkGroup"
1831+
],
1832+
"Effect": "Allow",
1833+
"Resource": {
1834+
"Fn::Sub": [
1835+
"arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/${workgroupName}",
1836+
{
1837+
"workgroupName": {
1838+
"Ref": "WorkGroupName"
1839+
}
1840+
}
1841+
]
1842+
}
1843+
}
1844+
]
1845+
},
1846+
"PolicyName": "KitchenSinkFunctionRolePolicy65"
17541847
}
17551848
],
17561849
"Tags": [

‎tests/translator/output/aws-cn/all_policy_templates.json‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1751,6 +1751,99 @@
17511751
]
17521752
},
17531753
"PolicyName": "KitchenSinkFunctionRolePolicy64"
1754+
},
1755+
{
1756+
"PolicyDocument": {
1757+
"Statement": [
1758+
{
1759+
"Action": [
1760+
"athena:ListWorkGroups",
1761+
"athena:GetWorkGroup",
1762+
"athena:GetExecutionEngines",
1763+
"athena:GetDatabase",
1764+
"athena:ListDataCatalogs",
1765+
"athena:ListDatabases",
1766+
"athena:ListTableMetadata",
1767+
"athena:GetTableMetadata"
1768+
],
1769+
"Effect": "Allow",
1770+
"Resource": "*"
1771+
},
1772+
{
1773+
"Action": [
1774+
"glue:GetDatabases",
1775+
"glue:GetDatabase",
1776+
"glue:GetTables",
1777+
"glue:GetTable"
1778+
],
1779+
"Effect": "Allow",
1780+
"Resource": [
1781+
{
1782+
"Fn::Sub": [
1783+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog",
1784+
{
1785+
"catalog": {
1786+
"Ref": "CatalogName"
1787+
}
1788+
}
1789+
]
1790+
},
1791+
{
1792+
"Fn::Sub": [
1793+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${databaseName}",
1794+
{
1795+
"databaseName": {
1796+
"Ref": "DatabaseName"
1797+
}
1798+
}
1799+
]
1800+
},
1801+
{
1802+
"Fn::Sub": [
1803+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${databaseName}/${tableName}",
1804+
{
1805+
"databaseName": {
1806+
"Ref": "DatabaseName"
1807+
},
1808+
"tableName": {
1809+
"Ref": "TableName"
1810+
}
1811+
}
1812+
]
1813+
}
1814+
]
1815+
},
1816+
{
1817+
"Action": [
1818+
"athena:StartQueryExecution",
1819+
"athena:GetQueryResults",
1820+
"athena:DeleteNamedQuery",
1821+
"athena:GetNamedQuery",
1822+
"athena:ListQueryExecutions",
1823+
"athena:StopQueryExecution",
1824+
"athena:GetQueryResultsStream",
1825+
"athena:ListNamedQueries",
1826+
"athena:CreateNamedQuery",
1827+
"athena:GetQueryExecution",
1828+
"athena:BatchGetNamedQuery",
1829+
"athena:BatchGetQueryExecution",
1830+
"athena:GetWorkGroup"
1831+
],
1832+
"Effect": "Allow",
1833+
"Resource": {
1834+
"Fn::Sub": [
1835+
"arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/${workgroupName}",
1836+
{
1837+
"workgroupName": {
1838+
"Ref": "WorkGroupName"
1839+
}
1840+
}
1841+
]
1842+
}
1843+
}
1844+
]
1845+
},
1846+
"PolicyName": "KitchenSinkFunctionRolePolicy65"
17541847
}
17551848
],
17561849
"Tags": [

0 commit comments

Comments
 (0)