【AWS】AWS CloudFormationを利用したAmazon DataZone環境構築

AWSTemplateFormatVersion: '2010-09-09'
Description: createdatazone

Parameters:
  # アカウントID
  AccountId:
    Type: String
    Default: ""

  # リージョン
  Region:
    Type: String
    Default: ""

  # S3バケットパス
  S3BucketPath:
    Type: String
    Default: ""

  # IAMUser
  IAMUser:
    Type: String
    Default: ""

  # ドメイン実行用ロール名
  DomainExecutionIAMRoleName:
    Type: String
    Default: ""

  # GlueACCESS管理用ロール名
  GlueAccessIAMRoleName:
    Type: String
    Default: ""

  # Provisioning用ロール名
  ProvisioningIAMRoleName:
    Type: String
    Default: ""

  # ドメイン名
  DataZoneDomainName:
    Type: String
    Default: ""

  # 管理用プロジェクト名
  DataZoneProject1Name:
    Type: String
    Default: ""

  # 分析用プロジェクト名
  DataZoneProject2Name:
    Type: String
    Default: ""

  # 環境プロファイル名
  DataZoneEnvironmentProfileName:
    Type: String
    Default: ""

  # 管理用環境名
  DataZoneEnvironmentName1:
    Type: String
    Default: ""

  # 分析用環境名
  DataZoneEnvironmentName2:
    Type: String
    Default: ""


Resources:
  # ドメイン実行用ロール
  DomainExecutionIAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: "datazone.amazonaws.com"
            Action:
              - "sts:AssumeRole"
              - "sts:TagSession"
            Condition:
              "StringEquals":
                "aws:SourceAccount": !Ref AccountId
              "ForAllValues:StringLike":
                "aws:TagKeys": "datazone*"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonDataZoneDomainExecutionRolePolicy
      RoleName: !Ref DomainExecutionIAMRoleName

  # GlueACCESS管理用ロール
  GlueAccessIAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: "datazone.amazonaws.com"
            Action: "sts:AssumeRole"
            Condition:
              "StringEquals":
                "aws:SourceAccount": !Ref AccountId
              "ArnEquals":
                "aws:SourceArn": !Sub "arn:aws:datazone:${Region}:${AccountId}:domain/*"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonDataZoneGlueManageAccessRolePolicy
      RoleName: !Ref GlueAccessIAMRoleName
    DependsOn: DomainExecutionIAMRole

  # Provisioning用ロール
  ProvisioningIAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: "datazone.amazonaws.com"
            Action: "sts:AssumeRole"
            Condition:
              "StringEquals":
                "aws:SourceAccount": !Ref AccountId
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonDataZoneRedshiftGlueProvisioningPolicy
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
      RoleName: !Ref ProvisioningIAMRoleName
    DependsOn: GlueAccessIAMRole

  # ドメインを作成
  DataZoneDomain:
    Type: AWS::DataZone::Domain
    Properties:
      DomainExecutionRole: !GetAtt DomainExecutionIAMRole.Arn
      Name: !Ref DataZoneDomainName

  # 管理用プロジェクト作成
  DataZoneProject1:
    Type: AWS::DataZone::Project
    Properties:
      DomainIdentifier: !Ref DataZoneDomain
      Name: !Ref DataZoneProject1Name

  # 分析用プロジェクト作成
  DataZoneProject2:
    Type: AWS::DataZone::Project
    Properties:
      DomainIdentifier: !Ref DataZoneDomain
      Name: !Ref DataZoneProject2Name

  # LakeFormation管理者にIAMUserを追加
  DataLakeAdmins:
    Type: AWS::LakeFormation::DataLakeSettings
    Properties:
      Admins:
        - DataLakePrincipalIdentifier: !Sub "arn:aws:iam::${AccountId}:user/${IAMUser}"

  # ブループリントの作成
  DataZoneEnvironmentBlueprintConfiguration:
    Type: AWS::DataZone::EnvironmentBlueprintConfiguration
    Properties:
      DomainIdentifier: !Ref DataZoneDomain
      EnabledRegions:
        - !Ref Region
      EnvironmentBlueprintIdentifier: DefaultDataLake
      ManageAccessRoleArn: !GetAtt GlueAccessIAMRole.Arn
      ProvisioningRoleArn: !GetAtt ProvisioningIAMRole.Arn
      RegionalParameters:
        - Parameters:
            S3Location: !Ref S3BucketPath
          Region: !Ref Region

  # 環境プロファイルの作成
  DataZoneEnvironmentProfile:
    Type: AWS::DataZone::EnvironmentProfile
    Properties:
      AwsAccountId: !Ref AccountId
      AwsAccountRegion: !Ref Region
      DomainIdentifier: !Ref DataZoneDomain
      EnvironmentBlueprintIdentifier: !GetAtt DataZoneEnvironmentBlueprintConfiguration.EnvironmentBlueprintId
      Name: !Ref DataZoneEnvironmentProfileName
      ProjectIdentifier: !GetAtt DataZoneProject1.Id
    DependsOn: DataZoneEnvironmentBlueprintConfiguration

  # 管理用環境の作成
  DataZoneEnvironment1:
    Type: AWS::DataZone::Environment
    Properties:
      DomainIdentifier: !Ref DataZoneDomain
      EnvironmentAccountIdentifier: !Ref AccountId
      EnvironmentAccountRegion: !Ref Region
      EnvironmentProfileIdentifier: !GetAtt DataZoneEnvironmentProfile.Id
      EnvironmentRoleArn: !GetAtt ProvisioningIAMRole.Arn
      Name: !Ref DataZoneEnvironmentName1
      ProjectIdentifier: !GetAtt DataZoneProject1.Id
    DependsOn: DataZoneEnvironmentProfile

  # 分析用環境の作成
  DataZoneEnvironment2:
    Type: AWS::DataZone::Environment
    Properties:
      DomainIdentifier: !Ref DataZoneDomain
      EnvironmentAccountIdentifier: !Ref AccountId
      EnvironmentAccountRegion: !Ref Region
      EnvironmentProfileIdentifier: !GetAtt DataZoneEnvironmentProfile.Id
      EnvironmentRoleArn: !GetAtt ProvisioningIAMRole.Arn
      Name: !Ref DataZoneEnvironmentName2
      ProjectIdentifier: !GetAtt DataZoneProject2.Id
    DependsOn: DataZoneEnvironmentProfile

Outputs:
  DataZoneDomainId:
    Value: !Ref DataZoneDomain
    Export:
      Name: DataZoneDomainId

  DataZoneProjectId1:
    Value: !GetAtt DataZoneProject1.Id
    Export:
      Name: DataZoneProjectId1

  DataZoneProjectId2:
    Value: !GetAtt DataZoneProject2.Id
    Export:
      Name: DataZoneProjectId2

  DataZoneExecution:
    Value: !GetAtt DomainExecutionIAMRole.Arn
    Export:
      Name: DataZoneExecutionIAMRole

  DataZoneGlueAccess:
    Value: !GetAtt GlueAccessIAMRole.Arn
    Export:
      Name: DataZoneGlueAccess

  DataZoneprovisioning:
    Value: !GetAtt ProvisioningIAMRole.Arn
    Export:
      Name: DataZoneprovisioning