Merge pull request #990 from xschildw/m-plfm-8054

PLFM-8054: Temporary access for Snowflake to datawarehouse S3 bucket

sceptre/synapseprod/config/prod/snowflake-access.yaml

@@ -0,0 +1,6 @@
+template:
+  path: snowflake-access.yaml
+stack_name: snowflake-accesss
+parameters:
+  SnowflakeAccountArn: "arn:aws:iam::449435941126:user/someUser"
+  SnowflakeAccountExternalId: !ssm /infra/SnowflakeAccountExternalId

sceptre/synapseprod/templates/snowflake-access.yaml

@@ -0,0 +1,63 @@
+Description: >
+  Setup cross account IAM access for Snowflake.
+  See https://docs.snowflake.com/en/user-guide/data-load-s3-config-storage-integration
+AWSTemplateFormatVersion: 2010-09-09
+Parameters:
+  SnowflakeAccountArn:
+    Type: String
+  SnowflakeAccountExternalId:
+    Type: String
+Resources:
+  SnowflakeServicePolicy:
+    Type: 'AWS::IAM::ManagedPolicy'
+    Properties:
+      PolicyDocument: |
+        {
+          "Version": "2012-10-17",
+          "Statement": [
+              {
+                  "Effect": "Allow",
+                  "Action": [
+                      "s3:GetObject",
+                      "s3:GetObjectVersion"
+                  ],
+                  "Resource": "arn:aws:s3:::prod.datawarehouse.sagebase.org/warehouse/*"
+              },
+              {
+                  "Effect": "Allow",
+                  "Action": [
+                      "s3:ListBucket",
+                      "s3:GetBucketLocation"
+                  ],
+                  "Resource": "arn:aws:s3:::prod.datawarehouse.sagebase.org",
+                  "Condition": {
+                      "StringLike": {
+                        "s3:prefix": [ "warehouse/*" ]
+                      }
+                  }
+              }
+          ]
+        }
+  SnowflakeServiceRole:
+    Type: "AWS::IAM::Role"
+    Properties:
+      Path: "/"
+      ManagedPolicyArns:
+        - !Ref SnowflakeServicePolicy
+      AssumeRolePolicyDocument:
+        Version: 2012-10-17
+        Statement:
+          - Effect: Allow
+            Principal:
+              AWS: !Sub ${SnowflakeAccountArn}
+            Action:
+              - sts:AssumeRole
+              - sts:TagSession
+            Condition:
+              StringEquals:
+                sts:ExternalId: !Sub ${SnowflakeAccountExternalId}
+Outputs:
+  SnowflakeServiceRoleArn:
+    Value: !GetAtt SnowflakeServiceRole.Arn
+    Export:
+      Name: !Sub '${AWS::StackName}-SnowflakeServiceRoleArn'