Amazon Athenaデータソースの設定

provider "aws" {
  region = "<REGION>"
}
 
# ベースマキナの IdP を信頼する OIDC プロバイダー
data "tls_certificate" "basemachina" {
  url = "https://idp.basemachina.com"
}
 
resource "aws_iam_openid_connect_provider" "basemachina" {
  url            = "https://idp.basemachina.com"
  client_id_list = ["<AUDIENCE>"]
  thumbprint_list = [
    data.tls_certificate.basemachina.certificates[length(data.tls_certificate.basemachina.certificates) - 1].sha1_fingerprint,
  ]
}
 
# ベースマキナが権限借用する IAM ロール
resource "aws_iam_role" "basemachina" {
  name = "<ROLE_NAME>"
 
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Federated = aws_iam_openid_connect_provider.basemachina.arn }
      Action    = "sts:AssumeRoleWithWebIdentity"
      Condition = {
        StringEquals = {
          "idp.basemachina.com:aud" = "<AUDIENCE>"
          "idp.basemachina.com:sub" = "tenant:<TENANT_SUBDOMAIN>:project:<PROJECT_ID>:environment:<ENVIRONMENT_ID>"
        }
      }
    }]
  })
}
 
# Athenaでのクエリ実行権限
resource "aws_iam_role_policy" "athena" {
  role = aws_iam_role.basemachina.id
 
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "athena:StartQueryExecution",
          "athena:StopQueryExecution",
          "athena:GetQueryExecution",
          "athena:GetQueryResults",
          "athena:GetWorkGroup",
          "athena:CreatePreparedStatement",
          "athena:GetPreparedStatement",
          "athena:UpdatePreparedStatement",
          "athena:DeletePreparedStatement",
        ]
        Resource = [
          "arn:aws:athena:<REGION>:<ACCOUNT_ID>:workgroup/primary",
          "arn:aws:athena:<REGION>:<ACCOUNT_ID>:datacatalog/AwsDataCatalog",
        ]
      },
    ]
  })
}

# Glueデータカタログの参照権限
resource "aws_iam_role_policy" "glue" {
  role = aws_iam_role.basemachina.id
 
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "glue:GetDatabase",
          "glue:GetDatabases",
          "glue:GetTable",
          "glue:GetTables",
          "glue:GetPartition",
          "glue:GetPartitions",
        ]
        Resource = [
          "arn:aws:glue:<REGION>:<ACCOUNT_ID>:catalog",
          "arn:aws:glue:<REGION>:<ACCOUNT_ID>:database/<DATABASE_NAME>",
          "arn:aws:glue:<REGION>:<ACCOUNT_ID>:table/<DATABASE_NAME>/*",
        ]
      },
    ]
  })
}
 
# データ本体とクエリ結果の出力先バケットへのアクセス権限
resource "aws_iam_role_policy" "s3" {
  role = aws_iam_role.basemachina.id
 
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = "s3:GetObject"
        Resource = "arn:aws:s3:::<DATA_BUCKET_NAME>/*"
      },
      {
        Effect   = "Allow"
        Action   = ["s3:ListBucket", "s3:GetBucketLocation"]
        Resource = "arn:aws:s3:::<DATA_BUCKET_NAME>"
      },
      {
        Effect   = "Allow"
        Action   = ["s3:GetObject", "s3:PutObject"]
        Resource = "arn:aws:s3:::<QUERY_RESULT_BUCKET_NAME>/*"
      },
      {
        Effect   = "Allow"
        Action   = ["s3:ListBucket", "s3:GetBucketLocation"]
        Resource = "arn:aws:s3:::<QUERY_RESULT_BUCKET_NAME>"
      },
    ]
  })
}

tenant:<TENANT_SUBDOMAIN>:project:<PROJECT_ID>:environment:<ENVIRONMENT_ID>

Condition = {
  StringEquals = {
    "idp.basemachina.com:aud" = "<AUDIENCE>"
  }
  StringLike = {
    "idp.basemachina.com:sub" = "tenant:<TENANT_SUBDOMAIN>:*"
  }
}