Athena Federated Query 経由で DynamoDB のデータを QuickSight で可視化するハンズオンでつまづいた部分の補足

Transform: AWS::Serverless-2016-10-31
Parameters:
  LambdaFunctionName:
    Description: This is the name of the lambda function that will be created. This
      name must satisfy the pattern ^[a-z0-9-_]{1,64}$
    Type: String
    AllowedPattern: ^[a-z0-9-_]{1,64}$
  SpillBucket:
    Description: The name of the bucket where this function can spill data.
    Type: String
  GlueConnection:
    Description: Name of glue connection storing connection details for Federated
      Data source.
    Type: String
  LambdaRoleArn:
    Description: (Optional) A custom role to be used by the Connector lambda
    Type: String
    Default: ''
  KmsKeyId:
    Description: (Optional) By default any data that is spilled to S3 is encrypted
      using AES-GCM and a randomly generated key. Setting a KMS Key ID allows your
      Lambda function to use KMS for key generation for a stronger source of encryption
      keys.
    Type: String
    Default: ''
Conditions:
  HasKmsKeyId:
    Fn::Not:
    - Fn::Equals:
      - Ref: KmsKeyId
      - ''
  NotHasLambdaRole:
    Fn::Equals:
    - Ref: LambdaRoleArn
    - ''
  CreateKmsPolicy:
    Fn::And:
    - Condition: HasKmsKeyId
    - Condition: NotHasLambdaRole
  IsRegionBAH:
    Fn::Equals:
    - Ref: AWS::Region
    - me-south-1
  IsRegionHKG:
    Fn::Equals:
    - Ref: AWS::Region
    - ap-east-1
Resources:
  ConnectorConfig:
    Type: AWS::Serverless::Function
    Properties:
      Environment:
        Variables:
          glue_connection:
            Ref: GlueConnection
      FunctionName:
        Ref: LambdaFunctionName
      PackageType: Image
      ImageUri:
        Fn::Sub:
        - ${Account}.dkr.ecr.${AWS::Region}.amazonaws.com/athena-federation-repository-dynamodb:2025.14.4
        - Account:
            Fn::If:
            - IsRegionBAH
            - '084828588479'
            - Fn::If:
              - IsRegionHKG
              - 183295418215
              - 292517598671
      Description: Enables Amazon Athena to communicate with DynamoDB, making your
        tables accessible via SQL
      Timeout: 900
      MemorySize: 3008
      Role:
        Fn::If:
        - NotHasLambdaRole
        - Fn::GetAtt:
          - FunctionRole
          - Arn
        - Ref: LambdaRoleArn
  FunctionRole:
    Condition: NotHasLambdaRole
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
      - Fn::Sub: arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
  FunctionExecutionPolicy:
    Condition: NotHasLambdaRole
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: FunctionExecutionPolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Action:
          - dynamodb:DescribeTable
          - dynamodb:ListSchemas
          - dynamodb:ListTables
          - dynamodb:Query
          - dynamodb:Scan
          - dynamodb:PartiQLSelect
          - glue:GetTableVersions
          - glue:GetPartitions
          - glue:GetTables
          - glue:GetTableVersion
          - glue:GetDatabases
          - glue:GetTable
          - glue:GetPartition
          - glue:GetDatabase
          - athena:GetQueryExecution
          Effect: Allow
          Resource: '*'
        - Action:
          - s3:GetObject
          - s3:ListBucket
          - s3:GetBucketLocation
          - s3:GetObjectVersion
          - s3:PutObject
          - s3:PutObjectAcl
          - s3:GetLifecycleConfiguration
          - s3:PutLifecycleConfiguration
          - s3:DeleteObject
          Effect: Allow
          Resource:
          - Fn::Sub:
            - arn:${AWS::Partition}:s3:::${bucketName}
            - bucketName:
                Ref: SpillBucket
          - Fn::Sub:
            - arn:${AWS::Partition}:s3:::${bucketName}/*
            - bucketName:
                Ref: SpillBucket
        - Action:
          - glue:GetConnection
          Effect: Allow
          Resource:
          - Fn::Sub: arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:connection/${GlueConnection}
          - Fn::Sub: arn:${AWS::Partition}:glue:${AWS::Region}:${AWS::AccountId}:catalog
      Roles:
      - Ref: FunctionRole
  FunctionKmsPolicy:
    Condition: CreateKmsPolicy
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: FunctionKmsPolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Action:
          - kms:GenerateRandom
          Effect: Allow
          Resource: '*'
        - Action:
          - kms:GenerateDataKey
          Effect: Allow
          Resource:
            Fn::Sub: arn:${AWS::Partition}:kms:${AWS::Region}:${AWS::AccountId}:key/${KmsKeyId}
      Roles:
      - Ref: FunctionRole

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "dynamodb:DescribeTable",
                "dynamodb:ListSchemas",
                "dynamodb:ListTables",
                "dynamodb:Query",
                "dynamodb:Scan",
                "dynamodb:PartiQLSelect",
                "glue:GetTableVersions",
                "glue:GetPartitions",
                "glue:GetTables",
                "glue:GetTableVersion",
                "glue:GetDatabases",
                "glue:GetTable",
                "glue:GetPartition",
                "glue:GetDatabase",
                "athena:GetQueryExecution"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:GetObjectVersion",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:GetLifecycleConfiguration",
                "s3:PutLifecycleConfiguration",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::federated-spill-123456789012-ap-northeast-1",
                "arn:aws:s3:::federated-spill-123456789012-ap-northeast-1/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "glue:GetConnection"
            ],
            "Resource": [
                "arn:aws:glue:ap-northeast-1:123456789012:connection/athenafederatedcatalog_athena_q37hj06v",
                "arn:aws:glue:ap-northeast-1:123456789012:catalog"
            ],
            "Effect": "Allow"
        }
    ]
}