pulumi_kinesis.py

mport pulumi_aws as aws


def main(aws_bucket_arn, stream_name, account_id):
    firehose_role = aws.iam.Role("firehoseRole", assume_role_policy="""{
      "Version": "2012-10-17",
      "Statement": [
        {
          "Action": "sts:AssumeRole",
          "Principal": {
            "Service": "firehose.amazonaws.com"
          },
          "Effect": "Allow",
          "Sid": ""
        }
      ]
    }
    """)
    role_policy = aws.iam.RolePolicy("role_policy",
                                     role=firehose_role.name,
                                     policy=f"""{{
    "Version": "2012-10-17",
    "Statement": [
        {{
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "glue:GetTable",
                "glue:GetTableVersion",
                "glue:GetTableVersions"
            ],
            "Resource": [
                "arn:aws:glue:us-west-2:{account_id}:catalog",
                "arn:aws:glue:us-west-2:{account_id}:database/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%",
                "arn:aws:glue:us-west-2:{account_id}:table/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"
            ]
        }},
        {{
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:GetBucketLocation",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:ListBucketMultipartUploads",
                "s3:PutObject"
            ],
            "Resource": [
                "{aws_bucket_arn}",
                "{aws_bucket_arn}/*"
            ]
        }},
        {{
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "lambda:InvokeFunction",
                "lambda:GetFunctionConfiguration"
            ],
            "Resource": "arn:aws:lambda:us-west-2:{account_id}:function:%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"
        }},
        {{
            "Effect": "Allow",
            "Action": [
                "kms:GenerateDataKey",
                "kms:Decrypt"
            ],
            "Resource": [
                "arn:aws:kms:us-west-2:{account_id}:key/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"
            ],
            "Condition": {{
                "StringEquals": {{
                    "kms:ViaService": "s3.us-west-2.amazonaws.com"
                }},
                "StringLike": {{
                    "kms:EncryptionContext:aws:s3:arn": [
                        "arn:aws:s3:::%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%/*"
                    ]
                }}
            }}
        }},
        {{
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:us-west-2:{account_id}:log-group:/aws/kinesisfirehose/{stream_name}:log-stream:*"
            ]
        }},
        {{
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "kinesis:DescribeStream",
                "kinesis:GetShardIterator",
                "kinesis:GetRecords",
                "kinesis:ListShards"
            ],
            "Resource": "arn:aws:kinesis:us-west-2:{account_id}:stream/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"
        }},
        {{
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt"
            ],
            "Resource": [
                "arn:aws:kms:us-west-2:{account_id}:key/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"
            ],
            "Condition": {{
                "StringEquals": {{
                    "kms:ViaService": "kinesis.us-west-2.amazonaws.com"
                }},
                "StringLike": {{
                    "kms:EncryptionContext:aws:kinesis:arn": "arn:aws:kinesis:us-west-2:{account_id}:stream/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"
                }}
            }}
        }}
    ]
    }}"""
                                     )
    stream = aws.kinesis.FirehoseDeliveryStream(stream_name,
                                                destination="s3",
                                                s3_configuration=
                                                aws.kinesis.FirehoseDeliveryStreamS3ConfigurationArgs(
                                                    role_arn=firehose_role.arn,
                                                    bucket_arn=aws_bucket_arn,
                                                    buffer_size=1,
                                                    buffer_interval=60,
                                                ))