Skip to content

Data platform (consumer)

A role that reads the storage the producer published, through two SSM parameters.

def build() -> cfn.Template:
    params = cfn.Params()
    key_arn = params.ssm("DataKeyArn", f"{PREFIX}/key-arn")  # a Ref: the value is looked up at deploy time
    bucket_arn = params.ssm("DataBucketArn", f"{PREFIX}/bucket-arn")

    statements = grants.S3.Bucket.read.on(bucket_arn, key_arn=key_arn)

    return {
        "AWSTemplateFormatVersion": "2010-09-09",
        "Parameters": params.declarations(),
        "Resources": {
            "ReaderRole": iam.role(
                RoleName="data-platform-reader",  # matches the producer's allowed-principals pattern
                AssumeRolePolicyDocument=cfn.assume_role_policy(service("lambda.amazonaws.com")),
                Policies=[iam.RolePolicyProperty(PolicyName="read-data", PolicyDocument=cfn.policy_document(statements))],
            ),
        },
    }

Rendered YAML

Committed as data-consumer.yaml:

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  DataKeyArn:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /data-platform/storage/key-arn
  DataBucketArn:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /data-platform/storage/bucket-arn
Resources:
  ReaderRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: data-platform-reader
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: read-data
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject*
                  - s3:GetBucket*
                  - s3:List*
                Resource:
                  - !Ref DataBucketArn
                  - !Join
                      - ''
                      -   - !Ref DataBucketArn
                          - /*
              - Effect: Allow
                Action:
                  - kms:Decrypt
                  - kms:DescribeKey
                Resource: !Ref DataKeyArn