SolutionGuidanceDataLakeS3GlueDB.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: |
  Automatic S3 Bucket and GlueDBs (SO9095)

Parameters:
  GlueDatabaseForEnriched:
    Type: String
    Default: 'afsaplakeenriched'
    Description: 'Glue Catalog database for Enriched Data'

  GlueDatabaseForCurated:
    Type: String
    Default: 'afsaplakecurated'
    Description: 'Glue Catalog database for Curated Data'  

Resources:
  ## S3 buckets
  afsaplakeraw:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub afsaplakeraw-${AWS::AccountId}
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256 
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  afsaplakeenriched:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub afsaplakeenriched-${AWS::AccountId}
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256 
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  afsaplakecurated:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub afsaplakecurated-${AWS::AccountId}
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256 
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  afsaplakedeployscript:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub afsaplake-deployscript-${AWS::AccountId}
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256 
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true      
 
   ## Bucket Policy
  afsaplakerawpolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref afsaplakeraw
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal: 
             AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
             Service: appflow.amazonaws.com
            Action:         
             - "s3:GetObject"
             - "s3:PutObject"
             - "s3:DeleteObject"
             - "s3:ListBucket"
             - "s3:GetBucketLocation"
             - "s3:ListBucketMultipartUploads"
             - "s3:AbortMultipartUpload"
             - "s3:ListMultipartUploadParts"
             - "s3:GetBucketAcl"
             - "s3:PutObjectAcl"

            Resource:
              - !Sub arn:aws:s3:::afsaplakeraw-${AWS::AccountId}
              - !Sub arn:aws:s3:::afsaplakeraw-${AWS::AccountId}/*

  afsaplakeenrichedpolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref afsaplakeenriched
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal: 
             AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
             Service: appflow.amazonaws.com
            Action:         
             - "s3:GetObject"
             - "s3:PutObject"
             - "s3:DeleteObject"
             - "s3:ListBucket"
             - "s3:GetBucketLocation"
             - "s3:ListBucketMultipartUploads"
             - "s3:AbortMultipartUpload"
             - "s3:ListMultipartUploadParts"
             - "s3:GetBucketAcl"
             - "s3:PutObjectAcl"
            Resource:
              - !Sub arn:aws:s3:::afsaplakeenriched-${AWS::AccountId}
              - !Sub arn:aws:s3:::afsaplakeenriched-${AWS::AccountId}/*             
      
  afsaplakecuratedpolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref afsaplakecurated
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal: 
             AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
             Service: appflow.amazonaws.com
            Action:         
             - "s3:GetObject"
             - "s3:PutObject"
             - "s3:DeleteObject"
             - "s3:ListBucket"
             - "s3:GetBucketLocation"
             - "s3:ListBucketMultipartUploads"
             - "s3:AbortMultipartUpload"
             - "s3:ListMultipartUploadParts"
             - "s3:GetBucketAcl"
             - "s3:PutObjectAcl"
            Resource:
              - !Sub arn:aws:s3:::afsaplakecurated-${AWS::AccountId}
              - !Sub arn:aws:s3:::afsaplakecurated-${AWS::AccountId}/*      

  afsaplakedeployscriptpolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref afsaplakedeployscript
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal: 
             AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
             Service: appflow.amazonaws.com
            Action:         
             - "s3:GetObject"
             - "s3:PutObject"
             - "s3:DeleteObject"
             - "s3:ListBucket"
             - "s3:GetBucketLocation"
             - "s3:ListBucketMultipartUploads"
             - "s3:AbortMultipartUpload"
             - "s3:ListMultipartUploadParts"
             - "s3:GetBucketAcl"
             - "s3:PutObjectAcl"

            Resource:   
              - !Sub arn:aws:s3:::afsaplake-deployscript-${AWS::AccountId}
              - !Sub arn:aws:s3:::afsaplake-deployscript-${AWS::AccountId}/* 
  ## Glue Databases
  GlueDatabaseForEnrichedData:
    Type: AWS::Glue::Database
    Properties:
      CatalogId: !Ref AWS::AccountId
      DatabaseInput:
        Name: !Ref GlueDatabaseForEnriched
        Description: 'Glue Catalog database for Enriched Data for SAP Datalake'
  
  GlueDatabaseForCuratedData:
    Type: AWS::Glue::Database
    Properties:
      CatalogId: !Ref AWS::AccountId
      DatabaseInput:
        Name: !Ref GlueDatabaseForCurated
        Description: 'Glue Catalog database for Curated Data for SAP Datalake'