Athena의 API 작업을 IAM으로 제어

Athena의 API는 현재 이것입니다.

pioho $ aws athena help
:
AVAILABLE COMMANDS
       o batch-get-named-query

       o batch-get-query-execution

       o create-named-query

       o delete-named-query

       o get-named-query

       o get-query-execution

       o get-query-results

       o help

       o list-named-queries

       o list-query-executions

       o start-query-execution

       o stop-query-execution

쿼리를 실행하여 쿼리의 상태를보고 결과를 얻습니다.

start-query-execution

pioho $ aws athena start-query-execution --query-string "select * from sampledb.elb_logs limit 10" --result-configuration OutputLocation=s3://aws-athena-query-results
{
    "QueryExecutionId": "0ec3a09e-144b-4a6c-b2f4-a2fb790e4141"
}

get-query-execution

pioho $ aws athena get-query-execution --query-execution-id 0ec3a09e-144b-4a6c-b2f4-a2fb790e4141
{
    "QueryExecution": {
        "Status": {
            "SubmissionDateTime": 1499483900.008, 
            "State": "SUCCEEDED", 
            "CompletionDateTime": 1499483901.083
        }, 
        "Query": "select * from sampledb.elb_logs limit 10", 
        "Statistics": {
            "DataScannedInBytes": 282613, 
            "EngineExecutionTimeInMillis": 956
        }, 
        "ResultConfiguration": {
            "OutputLocation": "s3://aws-athena-query-results/0ec3a09e-144b-4a6c-b2f4-a2fb790e4141.csv"
        }, 
        "QueryExecutionId": "0ec3a09e-144b-4a6c-b2f4-a2fb790e4141"
    }
}

get-query-results

pioho $ aws athena get-query-results --query-execution-id 0ec3a09e-144b-4a6c-b2f4-a2fb790e4141
{
    "ResultSet": {
        "Rows": [
            {
                "Data": [
                    {
                        "VarCharValue": "request_timestamp"
                    }, 
                    {
                        "VarCharValue": "elb_name"
                    }, 
                    {
                        "VarCharValue": "request_ip"
                    }, 
                    {
                        "VarCharValue": "request_port"
                    }, 
                    {
                        "Var
:
:
:

getresult 거부

IAM 정책을 Deny에서 만들고 적용합니다 (이미지는 허용되지만 ..)

Deny get-query-results

pioho $ aws athena get-query-results --query-execution-id 0ec3a09e-144b-4a6c-b2f4-a2fb790e4141
An error occurred (AccessDeniedException) when calling the GetQueryResults operation: User: arn:aws:iam::xxxxxxx:user/piko is not authorized to perform: athena:GetQueryResults

AWS Organizations

나머지는