Sample Athena Results S3 Policy for Restricted Data

s3_athena_restricted_policy.json

{
    "Version": "2012-10-17",
    "Id": "Policy1523289797898",
    "Statement": [
        {
            "Sid": "DenyRestrictedResultsAccess",
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": [
                    "arn:aws:iam::{{ aws_account_id }}:user/{{ aws_user_name }}"
                ]
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::aws-athena-query-results-{{ aws_account_id }}-us-east-1/*",
            "Condition": {
                "StringEquals": {
                    "s3:ExistingObjectTag/restriced_data": "True"
                }
            }
        },
        {
            "Sid": "DenyPolicyUpdates",
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": [
                    "arn:aws:iam::{{ aws_account_id }}:user/{{ aws_user_name }}"
                ]
            },
            "Action": "s3:PutBucketPolicy",
            "Resource": "arn:aws:s3:::aws-athena-query-results-{{ aws_account_id }}-us-east-1"
        }
    ]
}