panther-bi-iam-permissions.yml

# Copyright (C) 2022 Panther Labs, Inc.
#
# The Panther SaaS is licensed under the terms of the Panther Enterprise Subscription
# Agreement available at https://panther.com/enterprise-subscription-agreement/.
# All intellectual property rights in and to the Panther SaaS, including any and all
# rights to access the Panther SaaS, are governed by the Panther Enterprise Subscription Agreement.

AWSTemplateFormatVersion: 2010-09-09
Description: Athena Third Party BI Tool Permissions (Create access key post deployment for IAM user created).

Parameters:
  UserName:
    Type: String
    Default: PantherAthenaBI
    Description: Enter a name for the IAM user that will be created.
  RootStackName:
    Type: String
    Default: panther
    Description: Enter the Panther Root Stack Name.

Resources:
  Athena:
    Type: AWS::IAM::User
    Properties:
      UserName: !Ref UserName

  AthenaGroupMembership:
    Type: AWS::IAM::UserToGroupAddition
    Properties:
      GroupName: !Ref AthenaGroup
      Users:
        - !Ref Athena

  AthenaGroup:
    Type: AWS::IAM::Group
    Properties:
      GroupName: AthenaAnalytics

  AthenaGroupPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: ReadPantherProcessedData
      Groups:
        - !Ref AthenaGroup
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - athena:BatchGetQueryExecution
              - athena:CancelQueryExecution
              - athena:Get*
              - athena:List*
              - athena:RunQuery
              - athena:StartQueryExecution
              - athena:StopQueryExecution
            Resource: '*'
          - Effect: Allow
            Action:
              - glue:BatchGetPartition
              - glue:Get*
            Resource: '*'
          - Effect: Allow
            Action:
              - s3:AbortMultipartUpload
              - s3:GetBucketLocation
              - s3:GetObject
              - s3:ListBucket
              - s3:ListBucketMultipartUploads
              - s3:ListMultipartUploadParts
              - s3:PutObject
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${RootStackName}-*-athenaresults-*
              - !Sub arn:${AWS::Partition}:s3:::${RootStackName}-*-processeddata-*
              - !Sub arn:${AWS::Partition}:s3:::${RootStackName}-*-historicaldata-*
          - Effect: Allow
            Action: s3:ListAllMyBuckets
            Resource: '*'
          - Effect: Allow
            Action: lakeformation:GetDataAccess
            Resource: '*'

Outputs:
  IAMUser:
    Description: Panther Athena BI tool integration IAM user.
    Value: !Ref Athena