Snowflake エンタープライズDWH基盤 on AWS

import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";
import * as iam from "aws-cdk-lib/aws-iam";
import * as kms from "aws-cdk-lib/aws-kms";
import * as s3 from "aws-cdk-lib/aws-s3";

export class SnowflakeEnterpriseDwhAwsIntegrationStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const key = new kms.Key(this, "DataKey", { enableKeyRotation: true });
    const bucket = new s3.Bucket(this, "LandingBucket", {
      encryption: s3.BucketEncryption.KMS,
      encryptionKey: key,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      enforceSSL: true,
    });

    new iam.Role(this, "ExternalPlatformAccessRole", {
      assumedBy: new iam.AccountPrincipal("123456789012"),
      inlinePolicies: {
        S3LandingAccess: new iam.PolicyDocument({
          statements: [
            new iam.PolicyStatement({
              actions: ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
              resources: [bucket.bucketArn, bucket.arnForObjects("*")],
            }),
          ],
        }),
      },
    });
  }
}