Skip to content

Commit e9c80b8

Browse files
SmoothexSmoothex
committed
Introduce AthenaQueryPolicy_v2
1 parent 04ab7c8 commit e9c80b8

File tree

5 files changed

+352
-0
lines changed

5 files changed

+352
-0
lines changed

‎samtranslator/policy_templates_data/policy_templates.json‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,101 @@
170170
}
171171
}
172172
},
173+
"AthenaQueryPolicy_v2": {
174+
"Definition": {
175+
"Statement": [
176+
{
177+
"Action": [
178+
"athena:ListWorkGroups",
179+
"athena:GetWorkGroup",
180+
"athena:GetExecutionEngines",
181+
"athena:GetDatabase",
182+
"athena:ListDataCatalogs",
183+
"athena:ListDatabases",
184+
"athena:ListTableMetadata",
185+
"athena:GetTableMetadata"
186+
],
187+
"Effect": "Allow",
188+
"Resource": "*"
189+
},
190+
{
191+
"Action": [
192+
"glue:GetDatabases",
193+
"glue:GetDatabase",
194+
"glue:GetTables",
195+
"glue:GetTable"
196+
],
197+
"Effect": "Allow",
198+
"Resource": [
199+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog",
200+
{
201+
"Fn::Sub": [
202+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${databaseName}",
203+
{
204+
"databaseName": {
205+
"Ref": "DatabaseName"
206+
}
207+
}
208+
]
209+
},
210+
{
211+
"Fn::Sub": [
212+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${databaseName}/${tableName}",
213+
{
214+
"databaseName": {
215+
"Ref": "DatabaseName"
216+
},
217+
"tableName": {
218+
"Ref": "TableName"
219+
}
220+
}
221+
]
222+
}
223+
]
224+
},
225+
{
226+
"Action": [
227+
"athena:StartQueryExecution",
228+
"athena:GetQueryResults",
229+
"athena:DeleteNamedQuery",
230+
"athena:GetNamedQuery",
231+
"athena:ListQueryExecutions",
232+
"athena:StopQueryExecution",
233+
"athena:GetQueryResultsStream",
234+
"athena:ListNamedQueries",
235+
"athena:CreateNamedQuery",
236+
"athena:GetQueryExecution",
237+
"athena:BatchGetNamedQuery",
238+
"athena:BatchGetQueryExecution",
239+
"athena:GetWorkGroup"
240+
],
241+
"Effect": "Allow",
242+
"Resource": {
243+
"Fn::Sub": [
244+
"arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/${workgroupName}",
245+
{
246+
"workgroupName": {
247+
"Ref": "WorkGroupName"
248+
}
249+
}
250+
]
251+
}
252+
}
253+
]
254+
},
255+
"Description": "Gives permissions to execute Athena queries",
256+
"Parameters": {
257+
"DatabaseName": {
258+
"Description": "Name of the Glue Database"
259+
},
260+
"TableName": {
261+
"Description": "Name of the Glue Table"
262+
},
263+
"WorkGroupName": {
264+
"Description": "Name of the Athena Workgroup"
265+
}
266+
}
267+
},
173268
"CloudFormationDescribeStacksPolicy": {
174269
"Definition": {
175270
"Statement": [

‎tests/translator/input/all_policy_templates.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,11 @@ Resources:
160160
- AthenaQueryPolicy:
161161
WorkGroupName: name
162162

163+
- AthenaQueryPolicy_v2:
164+
WorkGroupName: name
165+
DatabaseName: name
166+
TableName: name
167+
163168
- S3WritePolicy:
164169
BucketName: name
165170

‎tests/translator/output/all_policy_templates.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1751,6 +1751,90 @@
17511751
]
17521752
},
17531753
"PolicyName": "KitchenSinkFunctionRolePolicy64"
1754+
},
1755+
{
1756+
"PolicyDocument": {
1757+
"Statement": [
1758+
{
1759+
"Action": [
1760+
"athena:ListWorkGroups",
1761+
"athena:GetWorkGroup",
1762+
"athena:GetExecutionEngines",
1763+
"athena:GetDatabase",
1764+
"athena:ListDataCatalogs",
1765+
"athena:ListDatabases",
1766+
"athena:ListTableMetadata",
1767+
"athena:GetTableMetadata"
1768+
],
1769+
"Effect": "Allow",
1770+
"Resource": "*"
1771+
},
1772+
{
1773+
"Action": [
1774+
"glue:GetDatabases",
1775+
"glue:GetDatabase",
1776+
"glue:GetTables",
1777+
"glue:GetTable"
1778+
],
1779+
"Effect": "Allow",
1780+
"Resource": [
1781+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog",
1782+
{
1783+
"Fn::Sub": [
1784+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${databaseName}",
1785+
{
1786+
"databaseName": {
1787+
"Ref": "DatabaseName"
1788+
}
1789+
}
1790+
]
1791+
},
1792+
{
1793+
"Fn::Sub": [
1794+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${databaseName}/${tableName}",
1795+
{
1796+
"databaseName": {
1797+
"Ref": "DatabaseName"
1798+
},
1799+
"tableName": {
1800+
"Ref": "TableName"
1801+
}
1802+
}
1803+
]
1804+
}
1805+
]
1806+
},
1807+
{
1808+
"Action": [
1809+
"athena:StartQueryExecution",
1810+
"athena:GetQueryResults",
1811+
"athena:DeleteNamedQuery",
1812+
"athena:GetNamedQuery",
1813+
"athena:ListQueryExecutions",
1814+
"athena:StopQueryExecution",
1815+
"athena:GetQueryResultsStream",
1816+
"athena:ListNamedQueries",
1817+
"athena:CreateNamedQuery",
1818+
"athena:GetQueryExecution",
1819+
"athena:BatchGetNamedQuery",
1820+
"athena:BatchGetQueryExecution",
1821+
"athena:GetWorkGroup"
1822+
],
1823+
"Effect": "Allow",
1824+
"Resource": {
1825+
"Fn::Sub": [
1826+
"arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/${workgroupName}",
1827+
{
1828+
"workgroupName": {
1829+
"Ref": "WorkGroupName"
1830+
}
1831+
}
1832+
]
1833+
}
1834+
}
1835+
]
1836+
},
1837+
"PolicyName": "KitchenSinkFunctionRolePolicy65"
17541838
}
17551839
],
17561840
"Tags": [

‎tests/translator/output/aws-cn/all_policy_templates.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1751,6 +1751,90 @@
17511751
]
17521752
},
17531753
"PolicyName": "KitchenSinkFunctionRolePolicy64"
1754+
},
1755+
{
1756+
"PolicyDocument": {
1757+
"Statement": [
1758+
{
1759+
"Action": [
1760+
"athena:ListWorkGroups",
1761+
"athena:GetWorkGroup",
1762+
"athena:GetExecutionEngines",
1763+
"athena:GetDatabase",
1764+
"athena:ListDataCatalogs",
1765+
"athena:ListDatabases",
1766+
"athena:ListTableMetadata",
1767+
"athena:GetTableMetadata"
1768+
],
1769+
"Effect": "Allow",
1770+
"Resource": "*"
1771+
},
1772+
{
1773+
"Action": [
1774+
"glue:GetDatabases",
1775+
"glue:GetDatabase",
1776+
"glue:GetTables",
1777+
"glue:GetTable"
1778+
],
1779+
"Effect": "Allow",
1780+
"Resource": [
1781+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog",
1782+
{
1783+
"Fn::Sub": [
1784+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${databaseName}",
1785+
{
1786+
"databaseName": {
1787+
"Ref": "DatabaseName"
1788+
}
1789+
}
1790+
]
1791+
},
1792+
{
1793+
"Fn::Sub": [
1794+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${databaseName}/${tableName}",
1795+
{
1796+
"databaseName": {
1797+
"Ref": "DatabaseName"
1798+
},
1799+
"tableName": {
1800+
"Ref": "TableName"
1801+
}
1802+
}
1803+
]
1804+
}
1805+
]
1806+
},
1807+
{
1808+
"Action": [
1809+
"athena:StartQueryExecution",
1810+
"athena:GetQueryResults",
1811+
"athena:DeleteNamedQuery",
1812+
"athena:GetNamedQuery",
1813+
"athena:ListQueryExecutions",
1814+
"athena:StopQueryExecution",
1815+
"athena:GetQueryResultsStream",
1816+
"athena:ListNamedQueries",
1817+
"athena:CreateNamedQuery",
1818+
"athena:GetQueryExecution",
1819+
"athena:BatchGetNamedQuery",
1820+
"athena:BatchGetQueryExecution",
1821+
"athena:GetWorkGroup"
1822+
],
1823+
"Effect": "Allow",
1824+
"Resource": {
1825+
"Fn::Sub": [
1826+
"arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/${workgroupName}",
1827+
{
1828+
"workgroupName": {
1829+
"Ref": "WorkGroupName"
1830+
}
1831+
}
1832+
]
1833+
}
1834+
}
1835+
]
1836+
},
1837+
"PolicyName": "KitchenSinkFunctionRolePolicy65"
17541838
}
17551839
],
17561840
"Tags": [

‎tests/translator/output/aws-us-gov/all_policy_templates.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1751,6 +1751,90 @@
17511751
]
17521752
},
17531753
"PolicyName": "KitchenSinkFunctionRolePolicy64"
1754+
},
1755+
{
1756+
"PolicyDocument": {
1757+
"Statement": [
1758+
{
1759+
"Action": [
1760+
"athena:ListWorkGroups",
1761+
"athena:GetWorkGroup",
1762+
"athena:GetExecutionEngines",
1763+
"athena:GetDatabase",
1764+
"athena:ListDataCatalogs",
1765+
"athena:ListDatabases",
1766+
"athena:ListTableMetadata",
1767+
"athena:GetTableMetadata"
1768+
],
1769+
"Effect": "Allow",
1770+
"Resource": "*"
1771+
},
1772+
{
1773+
"Action": [
1774+
"glue:GetDatabases",
1775+
"glue:GetDatabase",
1776+
"glue:GetTables",
1777+
"glue:GetTable"
1778+
],
1779+
"Effect": "Allow",
1780+
"Resource": [
1781+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog",
1782+
{
1783+
"Fn::Sub": [
1784+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:database/${databaseName}",
1785+
{
1786+
"databaseName": {
1787+
"Ref": "DatabaseName"
1788+
}
1789+
}
1790+
]
1791+
},
1792+
{
1793+
"Fn::Sub": [
1794+
"arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:table/${databaseName}/${tableName}",
1795+
{
1796+
"databaseName": {
1797+
"Ref": "DatabaseName"
1798+
},
1799+
"tableName": {
1800+
"Ref": "TableName"
1801+
}
1802+
}
1803+
]
1804+
}
1805+
]
1806+
},
1807+
{
1808+
"Action": [
1809+
"athena:StartQueryExecution",
1810+
"athena:GetQueryResults",
1811+
"athena:DeleteNamedQuery",
1812+
"athena:GetNamedQuery",
1813+
"athena:ListQueryExecutions",
1814+
"athena:StopQueryExecution",
1815+
"athena:GetQueryResultsStream",
1816+
"athena:ListNamedQueries",
1817+
"athena:CreateNamedQuery",
1818+
"athena:GetQueryExecution",
1819+
"athena:BatchGetNamedQuery",
1820+
"athena:BatchGetQueryExecution",
1821+
"athena:GetWorkGroup"
1822+
],
1823+
"Effect": "Allow",
1824+
"Resource": {
1825+
"Fn::Sub": [
1826+
"arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/${workgroupName}",
1827+
{
1828+
"workgroupName": {
1829+
"Ref": "WorkGroupName"
1830+
}
1831+
}
1832+
]
1833+
}
1834+
}
1835+
]
1836+
},
1837+
"PolicyName": "KitchenSinkFunctionRolePolicy65"
17541838
}
17551839
],
17561840
"Tags": [

0 commit comments

Comments
 (0)