From 4e7de84645113992f7fd1fdd23b780633419ed06 Mon Sep 17 00:00:00 2001 From: Mohamad Agil Date: Wed, 29 Jan 2025 16:12:57 +0000 Subject: [PATCH 1/2] Fix Athena permission for audit in dev --- .../hmpps-audit-dev/resources/athena-iam.tf | 6 ------ .../hmpps-audit-dev/resources/irsa.tf | 6 ------ 2 files changed, 12 deletions(-) diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-audit-dev/resources/athena-iam.tf b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-audit-dev/resources/athena-iam.tf index d1d2dbe5c18..c0e81cb509c 100644 --- a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-audit-dev/resources/athena-iam.tf +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-audit-dev/resources/athena-iam.tf @@ -41,16 +41,10 @@ data "aws_iam_policy_document" "athena" { "${aws_athena_workgroup.queries.arn}/*", "arn:aws:glue:eu-west-2:*:catalog", "arn:aws:glue:eu-west-2:*:database/${aws_athena_database.audit_database.id}", - "arn:aws:glue:eu-west-2:*:database/${aws_athena_database.audit_database.id}/*", "arn:aws:glue:eu-west-2:*:table/${aws_athena_database.audit_database.id}", "arn:aws:glue:eu-west-2:*:table/${aws_athena_database.audit_database.id}/*", module.s3.bucket_arn, "${module.s3.bucket_arn}/*", - - "arn:aws:athena:*:*:workgroup/hmpps_audit_${var.environment-name}", - "arn:aws:glue:eu-west-2:*:database/audit_${var.environment-name}", - "arn:aws:s3:::${module.s3.bucket_name}", - "arn:aws:s3:::${module.s3.bucket_name}/*" ] } } diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-audit-dev/resources/irsa.tf b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-audit-dev/resources/irsa.tf index 54eeab96840..f04b32ae532 100644 --- a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-audit-dev/resources/irsa.tf +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-audit-dev/resources/irsa.tf @@ -84,17 +84,11 @@ data "aws_iam_policy_document" "document" { "${aws_athena_workgroup.queries.arn}/*", "arn:aws:glue:eu-west-2:*:catalog", "arn:aws:glue:eu-west-2:*:database/${aws_athena_database.audit_database.id}", - "arn:aws:glue:eu-west-2:*:database/${aws_athena_database.audit_database.id}/*", "arn:aws:glue:eu-west-2:*:table/${aws_athena_database.audit_database.id}", "arn:aws:glue:eu-west-2:*:table/${aws_athena_database.audit_database.id}/*", module.s3.bucket_arn, "${module.s3.bucket_arn}/*", - "arn:aws:athena:*:*:workgroup/hmpps_audit_${var.environment-name}", - "arn:aws:glue:eu-west-2:*:database/audit_${var.environment-name}", - "arn:aws:s3:::${module.s3.bucket_name}", - "arn:aws:s3:::${module.s3.bucket_name}/*" - ] } } From 664afc5971c422a84794bee3d00d203e355189ff Mon Sep 17 00:00:00 2001 From: Mohamad Agil Date: Wed, 29 Jan 2025 18:12:33 +0000 Subject: [PATCH 2/2] Fix Athena permissions for audit in dev --- .../hmpps-audit-dev/resources/athena-iam.tf | 5 +++-- .../hmpps-audit-dev/resources/irsa.tf | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-audit-dev/resources/athena-iam.tf b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-audit-dev/resources/athena-iam.tf index c0e81cb509c..349f021388c 100644 --- a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-audit-dev/resources/athena-iam.tf +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-audit-dev/resources/athena-iam.tf @@ -37,8 +37,9 @@ data "aws_iam_policy_document" "athena" { ] resources = [ - aws_athena_workgroup.queries.arn, - "${aws_athena_workgroup.queries.arn}/*", + "arn:aws:athena:eu-west-2:*:workgroup/${aws_athena_workgroup.queries.name}", + "arn:aws:athena:eu-west-2:*:workgroup/${aws_athena_workgroup.queries.name}/*", + "arn:aws:athena:eu-west-2:*:query/*", "arn:aws:glue:eu-west-2:*:catalog", "arn:aws:glue:eu-west-2:*:database/${aws_athena_database.audit_database.id}", "arn:aws:glue:eu-west-2:*:table/${aws_athena_database.audit_database.id}", diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-audit-dev/resources/irsa.tf b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-audit-dev/resources/irsa.tf index f04b32ae532..7414cbdc4ce 100644 --- a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-audit-dev/resources/irsa.tf +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-audit-dev/resources/irsa.tf @@ -80,8 +80,9 @@ data "aws_iam_policy_document" "document" { "glue:DeleteTable", ] resources = [ - aws_athena_workgroup.queries.arn, - "${aws_athena_workgroup.queries.arn}/*", + "arn:aws:athena:eu-west-2:*:workgroup/${aws_athena_workgroup.queries.name}", + "arn:aws:athena:eu-west-2:*:workgroup/${aws_athena_workgroup.queries.name}/*", + "arn:aws:athena:eu-west-2:*:query/*", "arn:aws:glue:eu-west-2:*:catalog", "arn:aws:glue:eu-west-2:*:database/${aws_athena_database.audit_database.id}", "arn:aws:glue:eu-west-2:*:table/${aws_athena_database.audit_database.id}",