ãã®èšäºã¯ Centrally manage access and permissions for Amazon Redshift data sharing with AWS Lake Formation ã®ç¿»èš³èšäºã§ãã çŸä»£ã®ã°ããŒãã«ãªããŒã¿ããªãã³çµç¹ã¯ãããŒã¿ãè³ç£ãšããŠæ±ããããŸããŸãªäºæ¥éšé (LOB) ã§äœ¿çšããŠãã¿ã€ã ãªãŒãªæŽå¯ãšããé©åãªããžãã¹äžã®æææ±ºå®ãæšé²ããŠããŸãã Amazon Redshift ããŒã¿å
±æ ã䜿çšãããšãããã¯ã©ã¹ã¿ãŒããå¥ã®ã¯ã©ã¹ã¿ãŒã«ããŒã¿ãã³ããŒãããç§»åãããããããšãªãããã Amazon Redshift ããŒã¿ãŠã§ã¢ããŠã¹å
ã®ãã©ã³ã¶ã¯ã·ã§ã³ã®äžè²«æ§ãä¿ã£ãã©ã€ãããŒã¿ãå¥ã® Amazon Redshift ããŒã¿ãŠã§ã¢ããŠã¹ãšå®å
šã«å
±æã§ããŸããåã AWS ã¢ã«ãŠã³ãå
ãã¢ã«ãŠã³ãéããªãŒãžã§ã³éã§ããŒã¿å
±æã䜿çšå¯èœã§ãã äžéšã®ã客æ§ã¯ãç°ãªãã¢ã«ãŠã³ãã® 50 ïœ 100 ã®ããŒã¿ãŠã§ã¢ããŠã¹ãšããŒã¿ãå
±æããçžäºã«å
±æãè¡ã£ãŠããããã誰ãã©ã®ããŒã¿ã«ã¢ã¯ã»ã¹ããŠãããã远跡ããããšãå°é£ã«ãªã£ãŠããŸããã¢ã¯ã»ã¹æ
å ±ãååŸããã«ã¯ãåã
ã®ã¢ã«ãŠã³ãã® Amazon Redshift ã³ã³ãœãŒã«ã§ç¢ºèªããªããã°ãããŸããããŸããå€ãã®ã客æ§ã¯ã Amazon Simple Storage Service (Amazon S3) äžã«ããŒã¿ã¬ã€ã¯ãæã£ãŠãããããŸããŸãªããžãã¹ãŠãããå
ããã³ããžãã¹ãŠãããéã§å
±æãããŠããŸããçµç¹ãæé·ããããŒã¿ãæ°äž»åãããã«ã€ããŠã管çè
ã¯ã¬ããã³ã¹ãšç£æ»ã®ããã«ããŒã¿å
±æãäžå
管çãããã现ããã¢ã¯ã»ã¹å¶åŸ¡ãé©çšã§ããæ©èœãå¿
èŠãšããŠããŸãã ã客æ§ããã®èŠæããéç®ããŠãæ¬¡ã®æ°æ©èœãçºè¡šããŸããAmazon Redshift ããŒã¿å
±æãš AWS Lake Formation ã®çµ±åã«ãããAmazon Redshift ã®ã客æ§ã¯ AWS Lake Formation ã䜿çšã㊠Amazon Redshift ããŒã¿å
±æãžã®ã¢ã¯ã»ã¹ãäžå
管çã§ããããã«ãªããŸãã AWS Lake Formation ã¯ãAmazon S3 ãæŽ»çšããããŒã¿ã¬ã€ã¯ãäžå
管çããããã®äžè¬çãªéžæè¢ã§ããä»åãAWS Lake Formation ã«ãã Amazon Redshift ããŒã¿å
±æã®ãµããŒãã«ãããæ°ããèšèšãã¿ãŒã³ãå¢ããããŒã¿ãŠã§ã¢ããŠã¹å
šäœã®ã¬ããã³ã¹ãšã»ãã¥ãªãã£äœå¶ãåºããŸãããã®çµ±åã«ãããAWS Lake Formation ã䜿çšããŠããã§ãã¬ãŒããã AWS Identity and Access Management (IAM) ãŠãŒã¶ãŒããã³ IAM ããŒã«ã« Amazon Redshift ããŒã¿å
±æã§å
±æãããŠããããŒãã«ããã³ãã¥ãŒã«å¯Ÿãããã现ããã¢ã¯ã»ã¹å¶åŸ¡ãå®çŸ©ã§ããŸãã ã客æ§ã¯ãããžãã¹ãŠãããéã§ããŒã¿ãå
±æããã¡ã«ããºã ãæäŸãã ããŒã¿ã¡ãã·ã¥ ã®ã¢ãããŒããçšããŠããŸãããŸããã客æ§ã¯ ã¢ãã³ããŒã¿ã¢ãŒããã¯ã㣠ã䜿çšããŠãããŒã¿ã¬ã€ã¯ã¹ãã¢ã Amazon Redshift ã®ãããŒãžãã¹ãã¬ãŒãžããã®ããŒã¿ãããžãã¹ãŠãããéã§å
±æããŠããŸãã AWS Lake Formation ã¯ãããžãã¹ãŠãããå
ããã³ããžãã¹ãŠãããå
šäœã«ããŒã¿ã¬ããã³ã¹ãé©çšããæ©èœãæäŸããŸããããã«ãããå®å
šãªããŒã¿ã¢ã¯ã»ã¹ãšå
±æãç°¡åãªããŒã¿æ€åºãããã³ããŒã¿ã¢ã¯ã»ã¹ã®éäžç£æ»ãå¯èœã«ãªããŸãã ãŠãã€ãããèªç©º ã¯äººã
ãã€ãªããäžçãäžã€ã«ããäºæ¥ãè¡ã£ãŠããŸãã ãããŒã¿é§ååäŒæ¥ãšããŠããŠãã€ãããèªç©ºã¯ã驿°çãªã¢ãã³ããŒã¿é§ååã¢ããªã±ãŒã·ã§ã³ãæ§ç¯ããåæã³ãã¥ããã£åãã«çµ±åãããããŒã¿ãšåæãšã¯ã¹ããªãšã³ã¹ãçã¿åºãããšããŠããŸãã æã
ã¯ãAthenaãAuroraãAmazon RedshiftãAWS Lake Formation ãªã©ã®ããŸããŸãª AWS ãµãŒãã¹ã䜿çšã㊠Purpose Built ãªããŒã¿ã¡ãã·ã¥ ã¢ãŒããã¯ãã£ãæ§ç¯ãããã现ããããŒã¿ã¢ã¯ã»ã¹ãšã³ã©ãã¬ãŒã·ã§ã³ã«é¢ãã管çãšã¬ããã³ã¹ãç°¡çŽ åããããšã§ããããéæã§ãããšèããŠããŸããã -Ashok Srinivas, Director of ML Engineering and Sarang Bapat, Director of Data Engineering. ãã®æçš¿ã§ã¯ãAWS Lake Formation ã䜿ã£ãŠ Amazon Redshift ããŒã¿å
±æã®ã¢ã¯ã»ã¹ãšæš©éãäžå
管çããæ¹æ³ã瀺ããŸãã ãœãªã¥ãŒã·ã§ã³æŠèŠ ãã®ãœãªã¥ãŒã·ã§ã³ã§ã¯ãããŒã¿ã¬ããã³ã¹ã®ããã« Amazon Redshift ããŒã¿å
±æãš AWS Lake Formation ãçµ±åããããšãããŒã¿ãã¡ã€ã³ã®æ§ç¯ã«ã©ã®ããã«åœ¹ç«ã€ãããŸãããŒã¿ã¡ãã·ã¥ã¢ãããŒãã䜿çšããŠããŒã¿ãã¡ã€ã³ãçµ±åããããžãã¹ãŠãããå
šäœã§ã®ããŒã¿å
±æãšãã§ãã¬ãŒã·ã§ã³ãå¯èœã«ããæ¹æ³ã瀺ããŸããæ¬¡ã®å³ã¯ããœãªã¥ãŒã·ã§ã³ã®ã¢ãŒããã¯ãã£ã瀺ããŠããŸãã ããŒã¿ã¡ãã·ã¥ã¯ã忣åã®ãã¡ã€ã³æåã®ã¢ãŒããã¯ãã£ã§ããäžå
管çããããã§ãã¬ãŒãããããŒã¿ã«ã¿ãã°ãä»ããŠããŒã¿ãããã¥ãŒãµãŒãšããŒã¿ã³ã³ã·ã¥ãŒããŒãåé¢ããããšãéèŠããŠããŸããéåžžããããã¥ãŒãµãŒãšã³ã³ã·ã¥ãŒããŒã¯ããããç¬èªã®ã¢ã«ãŠã³ãå
ã§éçšãããŸãããããã®ããŒã¿ã¡ãã·ã¥ç¹æ§ã®è©³çŽ°ã¯æ¬¡ã®ãšããã§ãã ããŒã¿ãããã¥ãŒãµãŒ â ããŒã¿ãããã¥ãŒãµãŒã¯ããŒã¿ãããã¯ããææããããŒã¿ã®çæãæ£ç¢ºæ§ã®ç¶æãããŒã¿ãããã¯ããææ°ã®ç¶æ
ã«ä¿ã€è²¬ä»»ããããŸããããŒã¿ãããã¥ãŒãµãŒã¯ã©ã®ããŒã¿ã»ãããå
¬éããŠå©çšã§ããããæ±ºå®ããã»ã³ãã©ã«ã¬ããã³ã¹ã¢ã«ãŠã³ãã®äžå
管çãããããŒã¿ã«ã¿ãã°ã«ããŒã¿ã»ãããç»é²ããããšã§ããŒã¿ã»ãããå
±æããŸããã»ã³ãã©ã«ã®ã¬ããã³ã¹ã¹ãã¥ã¯ãŒããŸãã¯ç®¡çè
ããŒã ãšãšãã«ããŒã¿ãããã¯ãã管çããããã®ãããã¥ãŒãµãŒåŽã®ã¹ãã¥ã¯ãŒããŸãã¯ç®¡çè
ãååšããå ŽåããããŸãã ã»ã³ãã©ã«ã¬ããã³ã¹ã¢ã«ãŠã³ã â AWS Lake Formation ã«ãããå
±æããŒã¿ã»ããã«å¯Ÿãããã现ããã¢ã¯ã»ã¹ç®¡çãå¯èœã«ãªããŸããäžå
åãããããŒã¿ã«ã¿ãã°ã«ãããã³ã³ã·ã¥ãŒããŒã¯å
±æããŒã¿ã»ããããã°ããæ€çŽ¢ã§ããããã«ãªãã管çè
ã¯å
±æããŒã¿ã»ããã«å¯Ÿããã¢ã¯ã»ã¹èš±å¯ãäžå
管çã§ããããã«ãªããã»ãã¥ãªãã£ããŒã ã¯ããžãã¹ãŠãããå
šäœã§ã®ããŒã¿ãããã¯ãã®äœ¿çšç¶æ³ãç£æ»ããã³è¿œè·¡ã§ããããã«ãªããŸãã ããŒã¿ã³ã³ã·ã¥ãŒã㌠â ããŒã¿ã³ã³ã·ã¥ãŒããŒã¯ãã»ã³ãã©ã«ã¬ããã³ã¹ ã¢ã«ãŠã³ãããå
±æãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãååŸããŸãããããã®ãªãœãŒã¹ã¯ã³ã³ã·ã¥ãŒããŒã® AWS Glue ããŒã¿ã«ã¿ãã°å
ã§å©çšã§ãããããã³ã³ã·ã¥ãŒããŒåŽã®ããŒã¿ã¹ãã¥ã¯ãŒãã管çè
ã管çã§ããããŒã¿ããŒã¹ãããŒãã«ãžã®ãã现ããã¢ã¯ã»ã¹ãå¯èœã«ãªããŸãã æ¬¡ã®æé ã§ã¯ãããŒã¿ã¡ãã·ã¥ã¢ãŒããã¯ãã£ã®ã»ã³ãã©ã«ã¬ããã³ã¹ãã¿ãŒã³ã§ãAWS Lake Formation ã«ãã£ãŠ Amazon Redshift ããŒã¿å
±æãã©ã®ããã«çµ±å¶ç®¡çã§ãããã®æŠèŠã瀺ããŸãã ãããã¥ãŒãµãŒã¢ã«ãŠã³ãã§ã¯ã Amazon Redshift ãããã¥ãŒãµãŒã¯ã©ã¹ã¿ãŒå
ã«ããŒã¿ãªããžã§ã¯ããäœæããã³ç¶æãããŸããããŒã¿ãŠã§ã¢ããŠã¹ç®¡çè
ã¯ãAmazon Redshift ããŒã¿å
±æãäœæããããŒã¿ã»ãã (ããŒãã«ããã¥ãŒ) ãå
±æã«è¿œå ããŸãã ããŒã¿ãŠã§ã¢ããŠã¹ç®¡çè
ã¯ãã»ã³ãã©ã«ã¬ããã³ã¹ã¢ã«ãŠã³ãã®ããŒã¿ã«ã¿ãã°ãžã®ããŒã¿å
±æãžã®ã¢ã¯ã»ã¹ãèš±å¯ããŸãã ã»ã³ãã©ã«ã¬ããã³ã¹ã¢ã«ãŠã³ãã§ã¯ãããŒã¿ã¬ã€ã¯ç®¡çè
ã AWS Lake Formation ã§ç®¡çã§ããããã«Amazon Redshift ããŒã¿å
±æãåãå
¥ãã ãã®ããŒã¿å
±æãæã AWS Glue ããŒã¿ããŒã¹ãäœæããŸãã ããŒã¿ã¬ã€ã¯ç®¡çè
ã¯ã AWS Lake Formation ã®ã¯ãã¹ã¢ã«ãŠã³ãå
±æ ã䜿çšããŠãAWS Glue ããŒã¿ããŒã¹ãšããŒãã«ãã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ããšå
±æããŸãã ã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ãã§ã¯ãããŒã¿ã¬ã€ã¯ç®¡çè
㯠AWS Resource Access Manager (AWS RAM) çµç±ã§ãªãœãŒã¹å
±æã®æåŸ
ãåãå
¥ãããšããŒã¿ããŒã¹ããªã¹ããããŠããã®ã確èªã§ããŸãã ããŒã¿ã¬ã€ã¯ç®¡çè
ã¯ããã现ããã¢ã¯ã»ã¹å¶åŸ¡ãå®çŸ©ããã¢ã«ãŠã³ãå
ã® IAM ãŠãŒã¶ãŒ (ãã®æçš¿ã§ã¯ consumer1 ãš consumer2 ) ã«ããŒã¿ããŒã¹ãšããŒãã«ã«å¯Ÿããã¢ã¯ã»ã¹èš±å¯ãä»äžããŸãã Amazon Redshift ã¯ã©ã¹ã¿ãŒã§ã¯ãããŒã¿ãŠã§ã¢ããŠã¹ç®¡çè
ã Glue ããŒã¿ããŒã¹ãæã Amazon Redshift ããŒã¿ããŒã¹ãäœæããäœæããã Amazon Redshift ããŒã¿ããŒã¹ã®äœ¿çšã IAM ãŠãŒã¶ãŒã«èš±å¯ããŸãã IAM ãŠãŒã¶ãŒãšããŠã®ããŒã¿ã¢ããªã¹ãã¯ãAmazon Redshift ã¯ãšãªãšãã£ã¿ãªã©ã®å¥œã¿ã®ããŒã«ã䜿çšããŠãAWS Lake Formation ã®ãã现ããæš©éã«åºã¥ããŠããŒã¿ã»ããã«ã¢ã¯ã»ã¹ã§ããããã«ãªããŸãã ãã®æçš¿ã®äŸã§ã¯ã次ã®ã¢ã«ãŠã³ãèšå®ã䜿çšããŸãã ãããã¥ãŒãµãŒã¢ã«ãŠã³ã â 123456789012 ã»ã³ãã©ã«ã¢ã«ãŠã³ã â 112233445566 ã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ã â 665544332211 åææ¡ä»¶ Amazon Redshift ããŒã¿å
±æãäœæããããŒã¿ã»ããã远å ãã ãããã¥ãŒãµãŒã¢ã«ãŠã³ãã§ãæå·åãæå¹ã«ãã RA3 ããŒãã¿ã€ãã䜿çšã㊠Amazon Redshift ã¯ã©ã¹ã¿ãŒãäœæããŸããæ¬¡ã®æé ãå®è¡ããŸãã Amazon Redshift ã³ã³ãœãŒã«ã§ã ã¯ã©ã¹ã¿ãŒãµããããã°ã«ãŒã ãäœæããŸãã 詳现ã«ã€ããŠã¯ãã ã³ã³ãœãŒã«ã䜿çšããã¯ã©ã¹ã¿ãŒ ãµãããã ã°ã«ãŒãã®ç®¡ç ããåç
§ããŠãã ããã [Create cluster] ãéžæããŸãã [Cluster identifier] ã«ã¯ãéžæããã¯ã©ã¹ã¿ãŒåãæå®ããŸãã [Node type] ã§ãRA3 ããŒãã¿ã€ãã®ãããããéžæããŸãã ãã®æ©èœã¯ãRA3 ããŒãã¿ã€ãã§ã®ã¿ãµããŒããããŸãã [Number of nodes] ã«ãã¯ã©ã¹ã¿ãŒã«å¿
èŠãªããŒãã®æ°ãå
¥åããŸãã [Database configurations] ã§ã管çè
ãŠãŒã¶ãŒåãšç®¡çè
ãŠãŒã¶ãŒã®ãã¹ã¯ãŒããéžæããŸãã [Cluster permissions] ã§ãIAM ããŒã«ãéžæãããããããã©ã«ããšããŠèšå®ã§ããŸãã ããã©ã«ãã® IAM ããŒã«ã®è©³çްã«ã€ããŠã¯ãã Amazon Redshift çšã«ããã©ã«ãã® IAM ããŒã«ãäœæãã ããåç
§ããŠãã ããã ããã©ã«ãèšå®ã倿Žããã«ã¯ã [Additional configurations] ã®æšªã«ãã [Use defaults] ãªãã·ã§ã³ããªã³ã«ããŸãã [Network and security] ã§ã次ã®ããã«æå®ããŸãã [Virtual private cloud (VPC)] ã§ã¯ãã¯ã©ã¹ã¿ãŒããããã€ãã VPC ãéžæããŸãã [VPC security groups] ã§ã¯ãããã©ã«ãã®ãŸãŸã«ããããé©åãªã»ãã¥ãªã㣠ã°ã«ãŒãã远å ããŸãã [Cluster subnet group] ã§ãäœæããã¯ã©ã¹ã¿ãŒãµããããã°ã«ãŒããéžæããŸãã [Database configuration] ã® [Encryption] ã»ã¯ã·ã§ã³ã§ã[Use AWS Key Management Service (AWS KMS)] ãŸã㯠[Use a hardware security module (HSM)] ãéžæããŸãã æå·åã¯ããã©ã«ãã§ã¯ç¡å¹ã«ãªã£ãŠããŸãã [Choose an AWS KMS key] ã§ã¯ãæ¢åã® AWS Key Management Service (AWS KMS) ããŒãéžæãããããã㯠[Create an AWS KMS key] ãéžæããŠãæ°ããããŒãäœæããããšãã§ããŸãã æ°ããããŒãäœæããå Žåã«ã¯ãã ããŒã®äœæ ããåç
§ããŠãã ããã [Create cluster] ãéžæããŸãã ãã®æçš¿ã§ã¯ã次㮠ã¹ã¯ãªãã ã䜿çšããŠããŒãã«ãäœæãããããã¥ãŒãµãŒã® Amazon Redshift ã¯ã©ã¹ã¿ãŒã«ããŒã¿ãããŒãããŸãã ããŒã¿å
±æã®æ¿èª AWS Command Line Interface (AWS CLI) ã®ææ°ããŒãžã§ã³ãã€ã³ã¹ããŒã«ãŸãã¯æŽæ°ããŠãAWS CLI ãå®è¡ããŠããŒã¿å
±æãæ¿èªããŸããæé ã«ã€ããŠã¯ãã AWS CLI ã®ææ°ããŒãžã§ã³ã®ã€ã³ã¹ããŒã«ãŸãã¯æŽæ° ããåç
§ããŠãã ããã AWS Lake Formation ã®æš©éãèšå® AWS Lake Formation ã§ AWS Glue ããŒã¿ã«ã¿ãã°ã䜿çšããã«ã¯ãã»ã³ãã©ã«ã¬ããã³ã¹ã¢ã«ãŠã³ãã§æ¬¡ã®æé ãå®è¡ããŠãIAM ããŒã¹ã®ã¢ã¯ã»ã¹å¶åŸ¡ã§ã¯ãªããLake Formation ã®ã¢ã¯ã»ã¹èš±å¯ã䜿çšããŠã«ã¿ãã°ãªãœãŒã¹ãå¶åŸ¡ããããã«ããŒã¿ã«ã¿ãã°èšå®ãæŽæ°ããŸãã AWS Lake Formation ã³ã³ãœãŒã« ã«ç®¡çè
ãšããŠãµã€ã³ã€ã³ããŸãã ããã²ãŒã·ã§ã³ ãŠã£ã³ããŠã® [Data catalog] ã§ã [Settings] ãéžæããŸãã [Use only IAM access control for new databases] ã®éžæãè§£é€ããŸãã [Use only IAM access control for new tables in new databases] ã®éžæãè§£é€ããŸãã [Cross account version settings] ã§ [Version 3] ãéžæããŸãã [Save] ãéžæããŸãã IAM ãŠãŒã¶ãŒãããŒã¿ã¬ã€ã¯ç®¡çè
ãšããŠèšå®ãã æ¢åã®ããŒã¿ã¬ã€ã¯ç®¡çè
ãŠãŒã¶ãŒãŸãã¯ããŒã«ã䜿çšããŠããå Žåã¯ã次ã®ç®¡çããªã·ãŒã远å ãã以äžã®ã»ããã¢ããæé ãã¹ãããããŸãã AWSGlueServiceRole AmazonRedshiftFullAccess ãã以å€ã®å ŽåãIAM ãŠãŒã¶ãŒãããŒã¿ã¬ã€ã¯ç®¡çè
ãšããŠèšå®ããã«ã¯ãæ¬¡ã®æé ãå®è¡ããŸãã IAM ã³ã³ãœãŒã«ã®ããã²ãŒã·ã§ã³ãã€ã³ã§ [Users] ãéžæããŸãã ããŒã¿ã¬ã€ã¯ç®¡çè
ãšããŠæå®ãã IAM ãŠãŒã¶ãŒãéžæããŸãã [Permissions] ã¿ãã§ [Add an inline policy] ãéžæããŸãã <AccountID> ãèªåã®ã¢ã«ãŠã³ã ID ã«çœ®ãæããæ¬¡ã®ããªã·ãŒã远å ããŸãã { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action":"iam:CreateServiceLinkedRole", "Resource": "*", "Condition": { "StringEquals": { "iam:AWSServiceName":"lakeformation.amazonaws.com" } } }, { "Effect": "Allow", "Action": ["iam:PutRolePolicy"], "Resource": "arn:aws:iam::<AccountID>:role/aws-service role/lakeformation.amazonaws.com/AWSServiceRoleForLakeFormationDataAccess" }, { "Effect": "Allow", "Action": [ "ram:AcceptResourceShareInvitation", "ram:RejectResourceShareInvitation", "ec2:DescribeAvailabilityZones", "ram:EnableSharingWithAwsOrganization" ], "Resource": "*" } ] } JSON ããªã·ãŒåãæå®ããŸãã èšå®ã確èªããŠä¿åããŸãã [Add permissions] ãã¿ã³ãéžæãã[Attach existing policies directly] ãéžæããŸãã æ¬¡ã®ããªã·ãŒã远å ããŸãã AWSLakeFormationCrossAccountManager AWSGlueConsoleFullAccess AWSGlueServiceRole AWSLakeFormationDataAdmin AWSCloudShellFullAccess AmazonRedshiftFullAccess [Next: Review and add permissions] ãéžæããŸãã ããŒã¿ã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ãã®èšå® ã³ã³ã·ã¥ãŒã㌠ã¢ã«ãŠã³ãã§ã¯ãã»ã³ãã©ã«ã¬ããã³ã¹ã¢ã«ãŠã³ãã§åè¿°ããæé ã«åŸã£ãŠãAWS Lake Formation ãšããŒã¿ã¬ã€ã¯ç®¡çè
ãã»ããã¢ããããŸãã ããŒã¿ã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ãã§ãæå·åä»ãã® RA3 ããŒãã¿ã€ãã䜿çšã㊠Amazon Redshift ã¯ã©ã¹ã¿ãŒãäœæããŸã (ãããã¥ãŒãµãŒã¢ã«ãŠã³ãã§ Amazon Redshift ã¯ã©ã¹ã¿ãŒãäœæããæé ãåç
§ããŠãã ãã)ã [Launch Stack] ãéžæã㊠AWS CloudFormation ãã³ãã¬ãŒãããããã€ããããªã·ãŒãæã€ 2 人㮠IAM ãŠãŒã¶ãŒãäœæããŸãã ã¹ã¿ãã¯ã¯ãããŒã¿ã¢ããªã¹ããšããŠæ¬¡ã®ãŠãŒã¶ãŒãäœæããŸã consumer1 consumer2 CloudFormation ã¹ã¿ãã¯ãäœæãããããã¹ã¿ãã¯ã® [Outputs] ã¿ãã«ç§»åããŸãã ConsoleIAMLoginURL ãš LFUsersCredentials ã®å€ãååŸããŸãã LFUsersCredentials ã®å€ãéžæããŠã AWS Secrets Manager ã³ã³ãœãŒã«ã«ç§»åããŸãã [Secret value] ã»ã¯ã·ã§ã³ã§ã[Retrieve secret value] ãéžæããŸãã ãã¹ã¯ãŒãã®ã·ãŒã¯ã¬ããå€ãååŸããŸãã consumer1 ãš consumer2 ã¯ã©ã¡ããã AWSãããžã¡ã³ãã³ã³ãœãŒã« ã«ãã°ã€ã³ããããã«ããããšåããã¹ã¯ãŒãã䜿çšããå¿
èŠããããŸãã AWS Lake Formation ã䜿çšã㊠Amazon Redshift ããŒã¿å
±æãèšå®ãã ãããã¥ãŒãµãŒã¢ã«ãŠã³ã ã³ã³ãœãŒã«ã䜿çšããŠããŒã¿å
±æãäœæ ãããã¥ãŒãµãŒã¢ã«ãŠã³ãã§ Amazon Redshift ããŒã¿å
±æãäœæããã»ã³ãã©ã«ã¢ã«ãŠã³ãã® AWS Lake Formation ãšå
±æããã«ã¯ãæ¬¡ã®æé ãå®è¡ããŸãã Amazon Redshift ã³ã³ãœãŒã«ã§ãããŒã¿å
±æãäœæããã¯ã©ã¹ã¿ãŒãéžæããŸãã ã¯ã©ã¹ã¿ãŒã®è©³çްããŒãžã§ã [Datashares] ã¿ãã«ç§»åããŸãã [Datashares created in my namespace] ã§ã[Connect to database] ãéžæããŸãã [Create datashare] ãéžæããŸãã [Datashare type]ãšããŠã[Datashare] ãéžæããŸãã [Datashare name] ã«ååãå
¥åããŸã (ãã®æçš¿ã§ã¯ãdemotahoeds)ã [Database name] ã§ãããŒã¿å
±æãªããžã§ã¯ãã远å ããããŒã¿ããŒã¹ãéžæããŸã (ãã®æçš¿ã§ã¯ dev) ã [Publicly accessible] ã§ã[Turn off] ãéžæããŸã (ãŸãã¯ããããªãã¯ã«ã¢ã¯ã»ã¹å¯èœãªã¯ã©ã¹ã¿ãŒãšããŒã¿å
±æãå
±æããã«ã¯ [Turn on] ãéžæããŸã)ã [DataShare objects] ã§ã[Add] ãéžæããŠã¹ããŒããããŒã¿å
±æã«è¿œå ããŸã (ãã®æçš¿ã§ã¯ãããªã㯠ã¹ããŒã) ã [Tables and views] ã§ [Add] ãéžæããããŒãã«ãšãã¥ãŒãããŒã¿å
±æã«è¿œå ããŸã (ãã®æçš¿ã§ã¯ãããŒãã« customer ãšãã¥ãŒ customer_view ã远å ããŸã)ã [Data consumers] ã§ã[Publish to AWS Data Catalog] ãéžæããŸãã [Publish to the following accounts] ã§ã[Other AWS accounts] ãéžæããŸãã ã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ãã® AWS ã¢ã«ãŠã³ã ID ãæå®ããŸãããã®æçš¿ã§ã¯ãLake Formation äžå€®ã¬ããã³ã¹ ã¢ã«ãŠã³ãã® AWS ã¢ã«ãŠã³ã ID ãæäŸããŸãã åãã¢ã«ãŠã³ãå
ã§å
±æããã«ã¯ã[Local account] ãéžæããŸãã [Create datashare] ãéžæããŸãã ããŒã¿å
±æãäœæããããã[Datashares] ã¿ãã«æ»ãã [Datashares created in my namespace] ã®äžã®æ€çŽ¢ããŒã«ããŒã¿å
±æåãå
¥åããŠç¢ºèªã§ããŸãã ããŒã¿å
±æåãéžæãããšããã®è©³çްã衚瀺ãããŸãã [Data consumers] ã®äžã«ãã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ãã®ããŒã¿ã«ã¿ãã°ã®ã³ã³ã·ã¥ãŒããŒã®ã¹ããŒã¿ã¹ã [Pending Authorization] ãšããŠè¡šç€ºãããŸãã ã³ã³ã·ã¥ãŒããŒããŒã¿ã«ã¿ãã°ã®ãã§ãã¯ããã¯ã¹ãéžæãããšã [Authorize] ãã¿ã³ãæå¹ã«ãªããŸãã [Authorize] ãã¯ãªãã¯ããŠãã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ãã®ããŒã¿ã«ã¿ãã°ãžã®ããŒã¿å
±æã¢ã¯ã»ã¹ãæ¿èªãããšãã³ã³ã·ã¥ãŒããŒã®ã¹ããŒã¿ã¹ã [Authorized] ã«å€ãããŸãã SQL ã³ãã³ãã䜿çšããŠããŒã¿å
±æãäœæãã ãããã¥ãŒãµãŒã¢ã«ãŠã³ãã§ããŒã¿å
±æãäœæããã»ã³ãã©ã«ã¢ã«ãŠã³ãã® AWS Lake Formation ãšå
±æããã«ã¯ãæ¬¡ã®æé ãå®è¡ããŸãã Amazon Redshift ã³ã³ãœãŒã«ã®ããã²ãŒã·ã§ã³ãã€ã³ã§ã[Query editor V2] ãéžæããŸãã ã¯ã©ã¹ã¿ãŒåãéžæ (å³ã¯ãªãã¯) ãã[Edit connection] ãŸã㯠[Create Connection] ãéžæããŸãã [Authentication] ã§ã[Temporary credentials] ãéžæããŸãã ããŸããŸãªèªèšŒæ¹æ³ã®è©³çްã«ã€ããŠã¯ãã Amazon Redshift ããŒã¿ããŒã¹ã«æ¥ç¶ãã ããåç
§ããŠãã ããã [Database] ã«ããŒã¿ããŒã¹åãå
¥åããŸã (ãã®æçš¿ã§ã¯ dev) ã [User name] ã«ãããŒã¿ããŒã¹ãžã®ã¢ã¯ã»ã¹ãèš±å¯ããããŠãŒã¶ãŒãå
¥åããŸã (ãã®æçš¿ã§ã¯ awsuser) ã [Save] ãéžæããŠããŒã¿ããŒã¹ã«æ¥ç¶ããŸãã æ¬¡ã® SQL ã³ãã³ããå®è¡ããŠããŒã¿å
±æãäœæããå
±æããããŒã¿ãªããžã§ã¯ãã远å ããŸãã create datashare demotahoeds ; ALTER DATASHARE demotahoeds ADD SCHEMA PUBLIC ; ALTER DATASHARE demotahoeds ADD TABLE customer ; ALTER DATASHARE demotahoeds ADD TABLE customer_view ; Bash 次㮠SQL ã³ãã³ããå®è¡ããŠããããã¥ãŒãµãŒã®ããŒã¿å
±æãã»ã³ãã©ã«ã¬ããã³ã¹ã¢ã«ãŠã³ããšå
±æããŸãã GRANT USAGE ON DATASHARE demotahoeds TO ACCOUNT ' <central-aws-account-id> ' via DATA CATALOG Bash 次㮠SQL ã³ãã³ããå®è¡ãããšãäœæãããããŒã¿å
±æãšå
±æããããªããžã§ã¯ãã確èªã§ããŸãã DESC DATASHARE demotahoeds Bash AWS CLI ã䜿çšããŠæ¬¡ã®ã³ãã³ããå®è¡ããŠãã»ã³ãã©ã«ããŒã¿ã«ã¿ãã°ã«å¯ŸããããŒã¿å
±æãæ¿èªããAWS Lake Formation ãããŒã¿å
±æã管çã§ããããã«ããŸãã AWS ãããžã¡ã³ãã³ã³ãœãŒã«ã䜿çšããŠæ¿èªããæé ã«ã€ããŠã¯ãã ããŒã¿å
±æã®æ¿èªãšæ¿èªã®åãæ¶ã ããåç
§ããŠãã ããã aws redshift authorize-data-share \ --data-share-arn 'arn:aws:redshift: <producer-region> : <producer-aws-account-id> :datashare: <producer-cluster-namespace> /demotahoeds' \ --consumer-identifier DataCatalog/ <central-aws-account-id> Code 以äžã¯åºåäŸã§ãã { "DataShareArn": "arn:aws:redshift:us-east-1:XXXXXXXXXX:datashare:cd8d91b5-0c17-4567-a52a-59f1bdda71cd/demotahoeds", "ProducerArn": "arn:aws:redshift:us-east-1:XXXXXXXXXX:namespace:cd8d91b5-0c17-4567-a52a-59f1bdda71cd", "AllowPubliclyAccessibleConsumers": false, "DataShareAssociations": [{ "ConsumerIdentifier": "DataCatalog/XXXXXXXXXXXX", "Status": "AUTHORIZED", "CreatedDate": "2022-11-09T21:10:30.507000+00:00", "StatusChangeDate": "2022-11-09T21:10:50.932000+00:00" }] } JSON åã®ã»ã¯ã·ã§ã³ã§èª¬æããæé ã«åŸã£ãŠãã³ã³ãœãŒã«ã§ããŒã¿å
±æã®ã¹ããŒã¿ã¹ã確èªã§ããŸãã ã»ã³ãã©ã«ã«ã¿ãã°ã¢ã«ãŠã³ã ããŒã¿ã¬ã€ã¯ç®¡çè
ã¯ãã»ã³ãã©ã«ã¬ããã³ã¹ã¢ã«ãŠã³ãã§ AWS Lake Formation ãšã®ããŒã¿å
±æãåãå
¥ããŠç»é²ããåæ§ã«ããŒã¿ããŒã¹ãäœæããŸããæ¬¡ã®æé ãå®è¡ããŸãã ããŒã¿ã¬ã€ã¯ç®¡çè
ã® IAM ãŠãŒã¶ãŒãŸãã¯ããŒã«ãšããŠã³ã³ãœãŒã«ã«ãµã€ã³ã€ã³ããŸãã AWS Lake Formation ã³ã³ãœãŒã«ã«åããŠãã°ã€ã³ããå Žåã¯ã[Add myself] ãéžæãã[Get Started] ãéžæããŸãã ããã²ãŒã·ã§ã³ãã€ã³ã® [Data catalog] ã§ã [Data sharing] ãéžæãã [Configuration] ã¿ãã§ Amazon Redshift ããŒã¿å
±æã® Invitations ã衚瀺ããŸãã ããŒã¿å
±æãéžæãã[Review invitation] ãéžæããŸãã invitation ã®è©³çްã瀺ããŠã£ã³ããŠã衚瀺ãããŸãã [Accept] ãéžæããŠãAmazon Redshift ããŒã¿å
±æã AWS Glue ããŒã¿ã«ã¿ãã°ã«ç»é²ããŸãã AWS Glue ããŒã¿ããŒã¹ã®ååãå
¥åãã[Skip to Review and create] ãéžæããŸãã å
容ã確èªãã[Create database] ãéžæããŸãã AWS Glue ããŒã¿ããŒã¹ã Amazon Redshift ããŒã¿å
±æäžã«äœæããããšããããã®ããŒã¿ããŒã¹ã [Shared databases] ã§è¡šç€ºã§ããŸãã AWS CLI ã䜿çšããŠããŒã¿å
±æãç»é²ããããŒã¿ããŒã¹ãäœæããããšãã§ããŸããæ¬¡ã®ã³ãã³ãã䜿çšããŸãã ã»ã³ãã©ã«ã¢ã«ãŠã³ããšå
±æããã Amazon Redshift ããŒã¿å
±æã«ã€ããŠç¢ºèªããŸãã aws redshift describe-data-shares Bash Amazon Redshift ããŒã¿å
±æãåãå
¥ã㊠Data Catalog ã«é¢é£ä»ããŸãã aws redshift associate-data-share-consumer \ --data-share-arn 'arn:aws:redshift: <producer-region> : <producer-aws-account-id> :datashare: <producer-cluster-namespace> /demotahoeds' \ --consumer-arn arn:aws:glue:us-east-1: < central-aws-account-id > :catalog Bash 以äžã¯åºåäŸã§ãã { "DataShareArn": "arn:aws:redshift:us-east-1:123456789012:datashare:cd8d91b5-0c17-4567-a52a-59f1bdda71cd/demotahoeds", "ProducerArn": "arn:aws:redshift:us-east-1:123456789012:namespace:cd8d91b5-0c17-4567-a52a-59f1bdda71cd", "AllowPubliclyAccessibleConsumers": false, "DataShareAssociations": [ { "ConsumerIdentifier": "arn:aws:glue:us-east-1:112233445566:catalog", "Status": "ACTIVE", "ConsumerRegion": "us-east-1", "CreatedDate": "2022-11-09T23:25:22.378000+00:00", "StatusChangeDate": "2022-11-09T23:25:22.378000+00:00" } ] } JSON AWS Lake Formation ã« Amazon Redshift ããŒã¿å
±æãç»é²ããŸãã aws lakeformation register-resource \ --resource-arn arn:aws:redshift: < producer-region > : < producer-aws-account-id > :datashare: < producer-cluster-namespace > /demotahoeds Bash åãå
¥ãããã Amazon Redshift ããŒã¿å
±æãæã AWS Glue ããŒã¿ããŒã¹ãäœæããŸãã aws glue create-database --region <central-catalog-region> --cli-input-json '{ "CatalogId": " <central-aws-account-id> ", "DatabaseInput": { "Name": "demotahoedb", "FederatedDatabase": { "Identifier": "arn:aws:redshift: <producer-region> : <producer-aws-account-id> :datashare: <producer-cluster-namespace> /demotahoeds", "ConnectionName": "aws:redshift" } } }' JSON ããã§ãã»ã³ãã©ã«ã¬ããã³ã¹ã¢ã«ãŠã³ãã®ããŒã¿ã¬ã€ã¯ç®¡çè
ã¯ãAWS Lake Formation ã®ã¯ãã¹ã¢ã«ãŠã³ãå
±ææ©èœã䜿çšããŠãããŒã¿ããŒã¹ãšããŒãã«ã®äž¡æ¹ã«å¯Ÿããã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ããžã®ã¢ã¯ã»ã¹ã衚瀺ããã³å
±æã§ããããã«ãªããŸããã ããŒã¿ã³ã³ã·ã¥ãŒããŒã«ããŒã¿å
±æã¢ã¯ã»ã¹ãèš±å¯ãã å
±æããã AWS Glue ããŒã¿ããŒã¹ã«å¯Ÿããã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ããžã®ã¢ã¯ã»ã¹èš±å¯ãä»äžããã«ã¯ãæ¬¡ã®æé ãå®è¡ããŸãã AWS Lake Formation ã³ã³ãœãŒã«ã®ããã²ãŒã·ã§ã³ãã€ã³ã® [Permissions] ã§ã [Data lake permissions] ãéžæããŸãã [Grant] ãéžæããŸãã [Principals] ã§ã [External accounts] ãéžæããŸãã ã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ã ID ãå
¥åã㊠Enter ããŒãæŒããŸã (ãã®æçš¿ã§ã¯ 665544332211)ã [LF-Tags or catalog resources] ã§ã [Named data catalog resources] ãéžæããŸãã [Databases] ã§ã¯ãããŒã¿ããŒã¹ demotahoedb ãéžæããŸãã [Database permissions] ãš [Grantable permissions] ã®äž¡æ¹ã« [Describe] ãéžæããŸãã [Grant] ãéžæããŸãã ã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ãã«ããŒãã«ã«å¯Ÿããã¢ã¯ã»ã¹èš±å¯ãä»äžããã«ã¯ãæ¬¡ã®æé ãå®è¡ããŸãã AWS Lake Formation ã³ã³ãœãŒã«ã®ããã²ãŒã·ã§ã³ ãã€ã³ã® [Permissions] ã§ã[Data lake permissions] ãéžæããŸãã [Grant] ãéžæããŸãã [Principals] ã§ã [External accounts] ãéžæããŸãã ã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ããæå®ããŸã (ãã®æçš¿ã§ã¯ 665544332211 ã䜿çšããŸã)ã [LF-Tags or catalog resources] ã§ã [Named data catalog resources] ãéžæããŸãã [Databases] ã§ã¯ãããŒã¿ããŒã¹ [demotahoedb] ãéžæããŸãã [Tables] ã§ã [All tables] ãéžæããŸãã [Table permissions] ãš [Grantable permissions] ã®äž¡æ¹ã§ [Describe] ãš [Select] ãéžæããŸãã [Grant] ãéžæããŠå€æŽãé©çšããŸãã ã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ã ã³ã³ã·ã¥ãŒããŒç®¡çè
ã¯ã»ã³ãã©ã«ã¬ããã³ã¹ã¢ã«ãŠã³ãããå
±æãªãœãŒã¹ãåãåããæ¬¡ã®è¡šã«ç€ºãããã«ãã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ãå
ã®ä»ã®ãŠãŒã¶ãŒã«ã¢ã¯ã»ã¹ãå§ä»»ããŸãã IAM User Object Access Object Type Access Level consumer1 public.customer Table All consumer2 public.customer_view View specific columns: c_customer_id , c_birth_country , cd_gender , cd_marital_status , cd_education_status ããŒã¿ ã³ã³ã·ã¥ãŒã㌠ã¢ã«ãŠã³ãã§ãæ¬¡ã®æé ã«åŸã£ãŠãã¢ã«ãŠã³ããšå
±æãããŠãããªãœãŒã¹ãåãå
¥ããŸãã ããŒã¿ã¬ã€ã¯ç®¡çè
ã® IAM ãŠãŒã¶ãŒãŸãã¯ããŒã«ãšããŠã³ã³ãœãŒã«ã«ãµã€ã³ã€ã³ããŸãã AWS Lake Formation ã³ã³ãœãŒã«ã«åããŠãã°ã€ã³ããå Žåã¯ã[Add myself] ãéžæãã[Get Started] ãéžæããŸãã AWS RAM ã³ã³ãœãŒã«ã«ãµã€ã³ã€ã³ããŸãã ããã²ãŒã·ã§ã³ ãŠã£ã³ããŠã® [Shared with me] ã§ [Resource shares] ãéžæããä¿çäžã® Invitation ã衚瀺ããŸãã2 ã€ã® Invitation ãåãåããŸãã ä¿çäžã® Inviation ãéžæãããªãœãŒã¹å
±æãåãå
¥ããŸãã AWS Lake formation ã³ã³ãœãŒã«ã®ããã²ãŒã·ã§ã³ãã€ã³ã® [Data catalog] ã§ã[Databases] ãéžæããŠãã¯ãã¹ã¢ã«ãŠã³ãå
±æããŒã¿ããŒã¹ã衚瀺ããŸãã AWS Lake Formation ã䜿çšããŠããŒã¿ã¢ããªã¹ããš IAM ãŠãŒã¶ãŒã«ã¢ã¯ã»ã¹ãèš±å¯ãã ããã§ãã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ãã®ããŒã¿ã¬ã€ã¯ç®¡çè
ã¯ãå
±æããŒã¿ããŒã¹ãšããŒãã«ã«å¯Ÿããã¢ã¯ã»ã¹èš±å¯ãã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ãã®ãŠãŒã¶ãŒã«å§ä»»ã§ããããã«ãªããŸããã consumer1 ãš consumer2 ã«ããŒã¿ããŒã¹æš©éãä»äžãã IAM ãŠãŒã¶ãŒ consumer1 ãš consumer2 ã«ããŒã¿ããŒã¹æš©éãä»äžããã«ã¯ãæ¬¡ã®æé ã«åŸããŸãã AWS Lake Formation ã³ã³ãœãŒã«ã®ããã²ãŒã·ã§ã³ ãã€ã³ã® [Data catalog] ã§ã [Databases] ãéžæããŸãã ããŒã¿ããŒã¹ demotahoedb ãéžæãã [Actions] ã¡ãã¥ãŒãã [Grant] ãéžæããŸãã [Principals] ã§ã [IAM users and roles] ãéžæããŸãã IAM ãŠãŒã¶ãŒ consumer1 ãš consumer2 ãéžæããŸãã [LF-Tags or catalog resources] ã§ã¯ãdemotahoedb ãããŒã¿ããŒã¹ãšããŠãã§ã«éžæãããŠããŸãã [Database permissions] ã§ [Describe] ãéžæããŸãã [Grant] ãéžæããŠæš©éãé©çšããŸãã consumer1 ã«ããŒãã«æš©éãä»äžãã IAM ãŠãŒã¶ãŒ consumer1 ã«ããŒãã« public.customer ã«å¯Ÿããã¢ã¯ã»ã¹èš±å¯ãä»äžããã«ã¯ãæ¬¡ã®æé ã«åŸããŸãã ããã²ãŒã·ã§ã³ ãã€ã³ã® [Data catalog] ã§ã [Databases] ãéžæããŸãã ããŒã¿ããŒã¹ demotahoedb ãéžæãããActionsãã¡ãã¥ãŒãããGrantããéžæããŸãã [Principals] ã§ã [IAM users and roles] ãéžæããŸãã IAM ãŠãŒã¶ãŒ consumer1 ãéžæããŸãã [LF-Tags or catalog resources] ã§ã¯ã demotahoedb ãããŒã¿ããŒã¹ãšããŠãã§ã«éžæãããŠããŸãã [Tables] ã§ã public.customer ãéžæããŸãã [Table permissions] ã§ [Describe] ãš [Select] ãéžæããŸãã [Grant] ãéžæããŠæš©éãé©çšããŸãã consumer2 ã«åæš©éãä»äžãã IAM ãŠãŒã¶ãŒ consumer2 ã« public.customer_view ã®æ©å¯æ
å ±ã§ã¯ãªãåã«å¯Ÿããã¢ã¯ã»ã¹èš±å¯ãä»äžããã«ã¯ãæ¬¡ã®æé ã«åŸããŸãã ããã²ãŒã·ã§ã³ ãã€ã³ã® [Data catalog] ã§ã [Databases] ãéžæããŸãã ããŒã¿ããŒã¹ demotahoedb ãéžæãã [Actions] ã¡ãã¥ãŒãã [Grant] ãéžæããŸãã [Principals] ã§ã [IAM users and roles] ãéžæããŸãã IAM ãŠãŒã¶ãŒ consumer2 ãéžæããŸãã [LF-Tags or catalog resources] ã§ã¯ã demotahoedb ãããŒã¿ããŒã¹ãšããŠãã§ã«éžæãããŠããŸãã [Tables] ã§ã public.customer_view ãéžæããŸãã [Table permissions] ã§ [Select] ãéžæããŸãã [Data permissions] ã§ã [Column-based access] ãéžæããŸãã [Include columns] ãéžæããæ©å¯æ
å ±ã§ã¯ãªãå ( c_customer_id ã c_birth_country ã cd_gender ã cd_marital_status ãããã³ cd_education_status ) ãéžæããŸãã [Grant] ãéžæããŠæš©éãé©çšããŸãã ã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ãã® Amazon Redshift ã¯ã©ã¹ã¿ãŒããããŒã¿å
±æã®å©çšèšå®ãè¡ã ã³ã³ã·ã¥ãŒã㌠çšã® Amazon Redshift ããŒã¿ãŠã§ã¢ããŠã¹ã§ãQuery Editor V2 ã䜿çšããŠç®¡çè
ãŠãŒã¶ãŒãšããŠãã°ã€ã³ããæ¬¡ã®æé ãå®è¡ããŸãã æ¬¡ã® SQL ã³ãã³ãã䜿çšããŠãå
±æãããã«ã¿ãã°ããŒã¿ããŒã¹ãã Amazon Redshift ããŒã¿ããŒã¹ãäœæããŸãã CREATE DATABASE demotahoedb FROM ARN 'arn:aws:glue: <central-region> : <central-aws-account-id> :database/demotahoedb' WITH DATA CATALOG SCHEMA demotahoedb ; SQL 次㮠SQL ã³ãã³ããå®è¡ããŠãAmazon Redshift ããŒã¿ããŒã¹ãäœæããIAM ãŠãŒã¶ãŒ consumer1 ãš consumer2 ã«äœæããããŒã¿ããŒã¹ã«å¯Ÿã㊠USAGE ã®èš±å¯ãäžããŸãã CREATE USER IAM:consumer1 password disable ; CREATE USER IAM:consumer2 password disable ; GRANT USAGE ON DATABASE demotahoedb TO IAM:consumer1 ; GRANT USAGE ON DATABASE demotahoedb TO IAM:consumer2 ; Bash AWS Lake Formation ã¢ã¯ã»ã¹èš±å¯ã匷å¶ããããã« IAM èªèšŒãå©çšããŸããæ¬¡ã®æé ã«åŸã£ãŠã¯ãšãªãšãã£ã¿ v2 ãèšå®ããŸãã ã¯ãšãªãšãã£ã¿ v2 ã®å·Šäžé
ã«ããèšå®ã¢ã€ã³ã³ãéžæãã[Account Settings] ãéžæããŸãã [Connection settings] ã§ã[Authenticate with IAM credentials] ãéžæããŸãã [Save]ãéžæããŸãã ã³ã³ã·ã¥ãŒããŒãŠãŒã¶ãŒãšããŠå
±æããŒã¿ã»ãããã¯ãšãªãã IAM ãŠãŒã¶ãŒ consumer1 ã Amazon Redshift ããããŒã¿å
±æã¢ã¯ã»ã¹æš©ãããããšãæ€èšŒããã«ã¯ãæ¬¡ã®æé ãå®è¡ããŸãã IAM ãŠãŒã¶ãŒ consumer1 ãšããŠã³ã³ãœãŒã«ã«ãµã€ã³ã€ã³ããŸãã Amazon Redshift ã³ã³ãœãŒã«ã®ããã²ãŒã·ã§ã³ãã€ã³ã§ [Query Editor V2] ãéžæããŸãã ã³ã³ã·ã¥ãŒããŒã¯ã©ã¹ã¿ã«æ¥ç¶ããã«ã¯ãããªãŒ ãã¥ãŒ ãã€ã³ã§ã³ã³ã·ã¥ãŒããŒã¯ã©ã¹ã¿ãéžæããŸãã ããã³ããã衚瀺ããããã [Authentication] ã§ [Temporary credentials using your IAM identity] ãéžæããŸãã [Database] ã«ããŒã¿ããŒã¹åãå
¥åããŸã (ãã®æçš¿ã§ã¯ dev ) ã ãŠãŒã¶ãŒåã¯çŸåšã® IAM ã¢ã€ãã³ãã£ã㣠ã«ãããã³ã°ãããŸã(ãã®æçš¿ã§ã¯ consumer1 )ã [Save] ãéžæããŸãã ããŒã¿ããŒã¹ã«æ¥ç¶ããããæ¬¡ã® SQL ã³ãã³ãã䜿çšããŠãçŸåšãã°ã€ã³ããŠãããŠãŒã¶ãŒã確èªã§ããŸãã select current_user ; Bash ã³ã³ã·ã¥ãŒããŒã¢ã«ãŠã³ãã§äœæããããã§ãã¬ãŒã·ã§ã³ããŒã¿ããŒã¹ãæ€çŽ¢ããã«ã¯ã次㮠SQL ã³ãã³ããå®è¡ããŸãã SHOW DATABASES FROM DATA CATALOG [ ACCOUNT ' <id1> ' , ' <id2> ' ] [ LIKE 'expression' ] ; Bash consumer1 ã®æš©éãæ€èšŒããã«ã¯ã次㮠SQL ã³ãã³ããå®è¡ããŸãã select * from demotahoedb.public.customer limit 10 ; Bash 次ã®ã¹ã¯ãªãŒã³ã·ã§ããã«ç€ºãããã«ã consumer1 ã¯ããŒã¿å
±æã® customer ãªããžã§ã¯ãã«æ£åžžã«ã¢ã¯ã»ã¹ã§ããŸãã ã§ã¯ã consumer2 ãåãã³ã³ã·ã¥ãŒããŒã¯ã©ã¹ã¿äžã®ããŒã¿å
±æããŒãã«ãpublic.customerãã«ã¢ã¯ã»ã¹ã§ããªãããšãæ€èšŒããŠã¿ãŸãããã ã³ã³ãœãŒã«ãããã°ã¢ãŠãããIAM ãŠãŒã¶ãŒ consumer2 ãšããŠãµã€ã³ã€ã³ããŸãã åãæé ã«åŸã£ãŠãã¯ãšãªãšãã£ã¿ v2 ã䜿çšããŠããŒã¿ããŒã¹ã«æ¥ç¶ããŸãã æ¥ç¶ã§ããããåãã¯ãšãªãå®è¡ããŸãã select * from demotahoedb.public.customer limit 10 ; Bash ãŠãŒã¶ãŒ consumer2 ã¯ã次ã®ã¹ã¯ãªãŒã³ã·ã§ããã«ç€ºãããã«ãã¢ã¯ã»ã¹ã®æåŠãšã©ãŒãåãåãã¯ãã§ãã consumer2 ã«å¯Ÿãã public.customer_view ãã¥ãŒã® åã¬ãã«ã®ã¢ã¯ã»ã¹æš©éãæ€èšŒããŠã¿ãŸãããã consumer2 ãšããŠã¯ãšãªãšãã£ã¿ v2 ã«æ¥ç¶ããæ¬¡ã® SQL ã³ãã³ããå®è¡ããŸãã select c_customer_id,c_birth_country,cd_gender,cd_marital_status from demotahoedb.public.customer_view limit 10 ; Bash 次ã®ã¹ã¯ãªãŒã³ã·ã§ããã§ã¯ãconsumer2 ã AWS Lake Formation ã«ãã£ãŠèš±å¯ãããåã«ã®ã¿ã¢ã¯ã»ã¹ã§ããããšãããããŸãã ãŸãšã ããŒã¿ã¡ãã·ã¥ã¢ãããŒãã¯ãçµç¹ãããžãã¹ãŠãããéã§ããŒã¿ãå
±æã§ããæ¹æ³ãæäŸããŸããåãã¡ã€ã³ã¯ãããŒã¿ã®åã蟌ã¿ãããŒã¿åŠçãããŒã¿ã®æäŸãæ
åœããŸãããã¡ã€ã³ã®æ
åœè
ã¯ãããŒã¿ææè
ã§ãããã¡ã€ã³ã®å°éå®¶ã§ãããããŒã¿ã®åè³ªãšæ£ç¢ºæ§ã«å¯ŸããŠè²¬ä»»ãè² ããŸããããŒã¿ã¬ããã³ã¹ã®ããã« AWS Lake Formation ãš Amazon Redshift ããŒã¿å
±æã䜿çšãããšãããŒã¿ã¡ãã·ã¥ã¢ãŒããã¯ãã£ã®æ§ç¯ã容æã«ãªãããã现ããã¢ã¯ã»ã¹å¶åŸ¡ã«ããããžãã¹ãŠãããéã®ããŒã¿å
±æãšãã§ãã¬ãŒã·ã§ã³ãå¯èœã«ãªããŸãã AWS Lake Formation ãšã® Amazon Redshift ããŒã¿å
±æã®éå§ã«è²¢ç®ããŠããã ããçæ§ã«å¿ããæè¬ããããŸãã Debu Panda, Michael Chess, Vlad Ponomarenko, Ting Yan, Erol Murtezaoglu, Sharda Khubchandani, Rui Bi åèæ
å ± Modern Data Architecture on AWS Designing a data lake for growth and scale on the AWS Cloud Design a data mesh architecture using AWS Lake Formation and AWS Glue 翻蚳ã¯ãœãªã¥ãŒã·ã§ã³ã¢ãŒããã¯ãã®æ± ç° æ¬ä¹ãæ
åœããŸããã