automated-deployment/central-account/template.yaml [1190:1233]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  lfs3athenaoutput:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: Private
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: 'AES256'
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  lfs3athenaoutputPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref lfs3athenaoutput
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
              - 's3:GetObject'
              - 's3:PutObject'
              - 's3:PutObjectAcl'
            Effect: Allow
            Resource: !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref lfs3athenaoutput
                - /*
            Principal:
              AWS:
              - !Join [ ':', ['arn:aws:iam:', !Ref 'AWS::AccountId', 'root']]

  lfAthenaWorkGroup:
    Type: AWS::Athena::WorkGroup
    Properties:
      Name: LakeFormationCrossAccount
      Description: Workgroup to access Lake Formation Cross Account
      State: ENABLED
      WorkGroupConfiguration:
        ResultConfiguration:
          OutputLocation: !Sub "s3://${lfs3athenaoutput}/"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



automated-deployment/consumption-account/template.yaml [554:597]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  lfs3athenaoutput:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: Private
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: 'AES256'
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  lfs3athenaoutputPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref lfs3athenaoutput
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
              - 's3:GetObject'
              - 's3:PutObject'
              - 's3:PutObjectAcl'
            Effect: Allow
            Resource: !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref lfs3athenaoutput
                - /*
            Principal:
              AWS:
              - !Join [ ':', ['arn:aws:iam:', !Ref 'AWS::AccountId', 'root']]

  lfAthenaWorkGroup:
    Type: AWS::Athena::WorkGroup
    Properties:
      Name: LakeFormationCrossAccount
      Description: Workgroup to access Lake Formation Cross Account
      State: ENABLED
      WorkGroupConfiguration:
        ResultConfiguration:
          OutputLocation: !Sub "s3://${lfs3athenaoutput}/"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



