S3 Tables - Artie

Required settings

Table bucket ARN
AWS region
AWS access key ID and secret access key (from the script below)

Find table bucket ARN

To find your table bucket ARN, go to your AWS console, click on S3 and navigate to the table bucket tab.

S3 table bucket

Creating a service account

The service account will need S3 Tables API access.

Terraform script

variable "table_bucket_name" {
  type = string
}

variable "service_account_name" {
  type = string
}

// If the S3 Tables bucket is encrypted with KMS. Otherwise, remove the
// kms_key_id, region and account_id variables and the KMS statement below.
variable "kms_key_id" {
  type = string
}

// The Region and AWS account ID of the KMS key.
variable "region" {
  type = string
}

variable "account_id" {
  type = string
}

resource "aws_iam_policy" "s3_tables_policy" {
  name        = "S3TablesPolicy"
  description = "Policy that grants access to S3 tables and related resources"

  policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Effect = "Allow",
        Action = [
          "s3tables:CreateTable",
          // DeleteTable is used to drop the staging table after each flush, and to drop a table before a backfill.
          "s3tables:DeleteTable",
          "s3tables:GetTableBucket",
          "s3tables:GetTableMetadataLocation",
          "s3tables:ListTables",
          "s3tables:GetNamespace",
          "s3tables:ListNamespaces",
          // CreateNamespace is only required if you want Artie to create missing namespaces when the pipeline deploys.
          "s3tables:CreateNamespace"
        ],
        Resource = [
          "arn:aws:s3tables:*:*:bucket/${var.table_bucket_name}",
          "arn:aws:s3tables:*:*:bucket/${var.table_bucket_name}/*"
        ]
      },
      {
        Effect = "Allow",
        Action = [
          "s3tables:GetTable",
          "s3tables:GetTableData",
          "s3tables:GetTableMetadataLocation",
          "s3tables:PutTableData",
          "s3tables:UpdateTableMetadataLocation"
        ],
        Resource = [
          "arn:aws:s3tables:*:*:bucket/${var.table_bucket_name}/table/*"
        ]
      },
      // If the S3 Tables bucket is encrypted with KMS:
      {
        Effect = "Allow",
        Action = [
          "kms:GenerateDataKey",
          "kms:Decrypt",
        ],
        Resource = [
          "arn:aws:kms:${var.region}:${var.account_id}:key/${var.kms_key_id}",
        ]
      }
    ]
  })
}

resource "aws_iam_user" "s3_tables_user" {
  name = var.service_account_name
  path = "/"
}

resource "aws_iam_user_policy_attachment" "s3_tables_user_policy_attachment" {
  user       = aws_iam_user.s3_tables_user.name
  policy_arn = aws_iam_policy.s3_tables_policy.arn
}

resource "aws_iam_access_key" "s3_tables_user_key" {
  user = aws_iam_user.s3_tables_user.name
}

output "aws_access_key_id" {
  value     = aws_iam_access_key.s3_tables_user_key.id
  sensitive = true
}

output "aws_secret_access_key" {
  value     = aws_iam_access_key.s3_tables_user_key.secret
  sensitive = true
}

⌘I