Skip to content

Instantly share code, notes, and snippets.

@ryohang
Created June 16, 2021 20:25
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ryohang/758fdc5ac3b2549507372eb5d640bda2 to your computer and use it in GitHub Desktop.
Save ryohang/758fdc5ac3b2549507372eb5d640bda2 to your computer and use it in GitHub Desktop.
LakeFormation Cross Account Data Catalog https://youtu.be/jxa6eEO54dI
AWSTemplateFormatVersion: "2010-09-09"
Description: Share S3 as data location to Lake Formation main account
Parameters:
DataS3Bucket:
Description: Name of your data S3 bucket
Type: String
Resources:
DataLocationBucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref DataS3Bucket
PolicyDocument:
Statement:
- Effect: Allow
Principal:
AWS: arn:aws:iam::AWS_Account_ID:role/aws-service-role/lakeformation.amazonaws.com/AWSServiceRoleForLakeFormationDataAccess
Action: s3:ListBucket
Resource: !Join [ "", ["arn:aws:s3:::", !Ref DataS3Bucket] ]
- Effect: Allow
Principal:
AWS: arn:aws:iam::AWS_Account_ID:role/aws-service-role/lakeformation.amazonaws.com/AWSServiceRoleForLakeFormationDataAccess
Action:
- s3:DeleteObject
- s3:GetObject
- s3:PutObject
Resource: !Join [ "", ["arn:aws:s3:::", !Ref DataS3Bucket, "/*"] ]
- Effect: Allow
Principal:
AWS: arn:aws:iam::AWS_Account_ID:role/service-role/AWSGlueServiceRole-lakeformation-crawler
Action: s3:ListBucket
Resource: !Join [ "", ["arn:aws:s3:::", !Ref DataS3Bucket] ]
- Effect: Allow
Principal:
AWS: arn:aws:iam::AWS_Account_ID:role/service-role/AWSGlueServiceRole-lakeformation-crawler
Action:
- s3:GetObject
- s3:PutObject
Resource: !Join [ "", ["arn:aws:s3:::", !Ref DataS3Bucket, "/*"] ]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment