feat: grant Superset Staging access

[patheard]

Summary

Add the Superset Staging IAM access role to allow it access to the Data Lake.

Related

• https://github.com/cds-snc/platform-core-services/issues/617

[github-actions]

Production: buckets 🪣

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 0 to add, 3 to change, 0 to destroy

Show summary

CHANGE	NAME
update	aws_s3_bucket_policy.athena_bucket
	aws_s3_bucket_policy.curated_bucket
	aws_s3_bucket_policy.transformed_bucket

Show plan

Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_s3_bucket_policy.athena_bucket will be updated in-place
  ~ resource "aws_s3_bucket_policy" "athena_bucket" {
        id     = "cds-data-lake-athena-production"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Principal = {
                          ~ AWS = "arn:aws:iam::066023111852:role/SupersetAthenaRead" -> [
                              + "arn:aws:iam::257394494478:role/SupersetAthenaRead",
                              + "arn:aws:iam::066023111852:role/SupersetAthenaRead",
                            ]
                        }
                        # (4 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

  # aws_s3_bucket_policy.curated_bucket will be updated in-place
  ~ resource "aws_s3_bucket_policy" "curated_bucket" {
        id     = "cds-data-lake-curated-production"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Principal = {
                          ~ AWS = "arn:aws:iam::066023111852:role/SupersetAthenaRead" -> [
                              + "arn:aws:iam::257394494478:role/SupersetAthenaRead",
                              + "arn:aws:iam::066023111852:role/SupersetAthenaRead",
                            ]
                        }
                        # (4 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

  # aws_s3_bucket_policy.transformed_bucket will be updated in-place
  ~ resource "aws_s3_bucket_policy" "transformed_bucket" {
        id     = "cds-data-lake-transformed-production"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Principal = {
                          ~ AWS = "arn:aws:iam::066023111852:role/SupersetAthenaRead" -> [
                              + "arn:aws:iam::257394494478:role/SupersetAthenaRead",
                              + "arn:aws:iam::066023111852:role/SupersetAthenaRead",
                            ]
                        }
                        # (4 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

Plan: 0 to add, 3 to change, 0 to destroy.

Warning: Argument is deprecated

  with module.athena_bucket.aws_s3_bucket.this,
  on .terraform/modules/athena_bucket/S3/main.tf line 8, in resource "aws_s3_bucket" "this":
   8: resource "aws_s3_bucket" "this" {

Use the aws_s3_bucket_logging resource instead

(and 22 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"

Show Conftest results

20 tests, 20 passed, 0 warnings, 0 failures, 0 exceptions

[github-actions]

Production: glue 🧴

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 0 to add, 1 to change, 0 to destroy

Show summary

CHANGE	NAME
update	aws_glue_resource_policy.cross_account_access

Show plan

Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_glue_resource_policy.cross_account_access will be updated in-place
  ~ resource "aws_glue_resource_policy" "cross_account_access" {
        id     = "ca-central-1"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Principal = {
                          ~ AWS = "arn:aws:iam::066023111852:role/SupersetAthenaRead" -> [
                              + "arn:aws:iam::257394494478:role/SupersetAthenaRead",
                              + "arn:aws:iam::066023111852:role/SupersetAthenaRead",
                            ]
                        }
                        # (4 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
    }

Plan: 0 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_glue_catalog_database.operations_aws_production"]
WARN - plan.json - main - Missing Common Tags: ["aws_glue_catalog_database.operations_aws_production_raw"]
WARN - plan.json - main - Missing Common Tags: ["aws_glue_crawler.operations_aws_production_account_tags"]
WARN - plan.json - main - Missing Common Tags: ["aws_glue_crawler.operations_aws_production_cost_usage_report"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.glue_crawler"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.glue_etl"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.glue_crawler"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.glue_etl"]
WARN - plan.json - main - Missing Common Tags: ["aws_kms_key.aws_glue"]

28 tests, 19 passed, 9 warnings, 0 failures, 0 exceptions