feat: add Athena workgroup

Add an Athena workgroup and query result bucket.  This will allow queries to
be run against the data lake buckets.

.github/workflows/terragrunt-apply-production.yml

@@ -48,6 +48,10 @@ jobs:
         working-directory: terragrunt/env/production/glue
         run: terragrunt apply --terragrunt-non-interactive -auto-approve
 
+      - name: Terragrunt apply athena
+        working-directory: terragrunt/env/production/athena
+        run: terragrunt apply --terragrunt-non-interactive -auto-approve
+
       - name: Terragrunt apply alarms
         working-directory: terragrunt/env/production/alarms
         run: terragrunt apply --terragrunt-non-interactive -auto-approve

.github/workflows/terragrunt-plan-production.yml

@@ -59,6 +59,15 @@ jobs:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
           terragrunt: "true"
 
+      - name: Terragrunt plan athena
+        uses: cds-snc/terraform-plan@25afd759b2ada46a94b011fab7a81963c4f3a61a # v3.3.0
+        with:
+          directory: "terragrunt/env/production/athena"
+          comment-delete: "true"
+          comment-title: "Production: athena 🦉"
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+          terragrunt: "true"
+
       - name: Terragrunt plan alarms
         uses: cds-snc/terraform-plan@25afd759b2ada46a94b011fab7a81963c4f3a61a # v3.3.0
         with:

terragrunt/aws/athena/athena.tf

@@ -0,0 +1,16 @@
+resource "aws_athena_workgroup" "data_lake" {
+  name = "data-lake-${var.env}"
+
+  configuration {
+    enforce_workgroup_configuration    = true
+    publish_cloudwatch_metrics_enabled = true
+
+    result_configuration {
+      output_location = "s3://${var.athena_bucket_name}/data-lake/"
+
+      encryption_configuration {
+        encryption_option = "SSE_S3"
+      }
+    }
+  }
+}

terragrunt/aws/athena/variables.tf

@@ -0,0 +1,9 @@
+variable "athena_bucket_arn" {
+  description = "The ARN of the Athena bucket"
+  type        = string
+}
+
+variable "athena_bucket_name" {
+  description = "The name of the Athena bucket"
+  type        = string
+}

terragrunt/aws/buckets/athena.tf

@@ -0,0 +1,22 @@
+#
+# Holds Athena query resuts
+#
+module "athena_bucket" {
+  source            = "github.com/cds-snc/terraform-modules//S3?ref=v10.0.0"
+  bucket_name       = "cds-data-lake-athena-${var.env}"
+  billing_tag_value = var.billing_tag_value
+
+  logging = {
+    target_bucket = module.log_bucket.s3_bucket_id
+    target_prefix = "athena/"
+  }
+
+  lifecycle_rule = [
+    local.lifecycle_expire_all,
+    local.lifecycle_remove_noncurrent_versions
+  ]
+
+  versioning = {
+    enabled = true
+  }
+}

terragrunt/aws/buckets/outputs.tf

@@ -1,3 +1,13 @@
+output "athena_bucket_arn" {
+  description = "ARN of the S3 Athena query result bucket."
+  value       = module.athena_bucket.s3_bucket_arn
+}
+
+output "athena_bucket_name" {
+  description = "Name of the S3 Athena query result bucket."
+  value       = module.athena_bucket.s3_bucket_id
+}
+
 output "curated_bucket_arn" {
   description = "ARN of the S3 Curated data bucket."
   value       = module.curated_bucket.s3_bucket_arn

terragrunt/aws/glue/iam.tf

@@ -121,9 +121,9 @@ data "aws_iam_policy_document" "glue_kms" {
       "logs:AssociateKmsKey"
     ]
     resources = [
-      "arn:aws:logs:${var.region}:${var.account_id}:log-group:${local.glue_crawler_log_group_name}*",
-      "arn:aws:logs:${var.region}:${var.account_id}:log-group:${local.glue_etl_log_group_name}*",
-      "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws-glue/sessions/*",
+      "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws-glue/crawlers*",
+      "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws-glue/jobs*",
+      "arn:aws:logs:${var.region}:${var.account_id}:log-group:/aws-glue/sessions*"
     ]
   }
 }
@@ -133,6 +133,7 @@ data "aws_iam_policy_document" "s3_write_data_lake" {
     sid = "WriteDataLakeS3TransformedBuckets"
     actions = [
       "s3:PutObject",
+      "s3:DeleteObject"
     ]
     resources = [
       "${var.curated_bucket_arn}/*",

terragrunt/env/production/athena/terragrunt.hcl

@@ -0,0 +1,26 @@
+terraform {
+  source = "../../../aws//athena"
+}
+
+dependencies {
+  paths = ["../buckets"]
+}
+
+dependency "buckets" {
+  config_path                             = "../buckets"
+  mock_outputs_merge_strategy_with_state  = "shallow"
+  mock_outputs_allowed_terraform_commands = ["init", "fmt", "validate", "plan", "show"]
+  mock_outputs = {
+    athena_bucket_arn  = "arn:aws:s3:::mock-athena-bucket"
+    athena_bucket_name = "mock-athena-bucket"
+  }
+}
+
+inputs = {
+  athena_bucket_arn  = dependency.buckets.outputs.athena_bucket_arn
+  athena_bucket_name = dependency.buckets.outputs.athena_bucket_name
+}
+
+include {
+  path = find_in_parent_folders()
+}