Usage

Deployed Resources

Once deployed, you should see the following in your AWS account:

Naming convention: <org>-<env>-<domain>-<module>-<resource>

SSM parameters: /<org>/<domain>/<module>/<resource-type>/<resource-name>/<attribute>

Resource	Deployed Name / SSM Path	Config Reference
Audit S3 Bucket	`<org>-dev-govern1-audit-audit` `/<org>/govern1/audit/bucket/name`	deployed by `common/governance/audit.yaml`
Audit KMS Key	`<org>-dev-govern1-audit-audit` `/<org>/govern1/audit/kms/arn`	deployed by `common/governance/audit.yaml`
CloudTrail Trail	`<org>-dev-govern1-audit-trail-s3-audit`	`trails.s3-audit` in `common/governance/audit-trail.yaml`
DataZone Domain	`<org>-dev-govern1-datazone-domain1` `/<org>/govern1/datazone/domain/domain1/name`	`domains.domain1` in `domain1/governance/datazone.yaml`
S3 Bucket	`<org>-dev-data1-datalake-raw` `/<org>/data1/datalake/bucket/raw/name`	`buckets.raw` in `domain1/data/datalake.yaml`
S3 Bucket	`<org>-dev-data1-datalake-transformed` `/<org>/data1/datalake/bucket/transformed/name`	`buckets.transformed` in `domain1/data/datalake.yaml`
S3 Bucket	`<org>-dev-data1-datalake-curated` `/<org>/data1/datalake/bucket/curated/name`	`buckets.curated` in `domain1/data/datalake.yaml`
Glue Database	`<org>-dev-dataops1-project1-sample-database1` `/<org>/dataops1/project1/database/name`	`databases.sample-database1` in `domain1/dataops/project1.yaml`
Glue Crawler	`<org>-dev-dataops1-crawler1-crawler1` `/<org>/dataops1/crawler1/crawler/crawler1/name`	`crawlers.crawler1` in `domain1/dataops/crawler1.yaml`
IAM Role	`<org>-dev-govern1-roles-data-admin` `/<org>/govern1/generated-role/data-admin/id`	`generateRoles.data-admin` in `common/governance/roles.yaml`
IAM Role	`<org>-dev-govern1-roles-data-engineer` `/<org>/govern1/generated-role/data-engineer/id`	`generateRoles.data-engineer` in `common/governance/roles.yaml`
IAM Role	`<org>-dev-govern1-roles-data-user1` `/<org>/govern1/generated-role/data-user1/id`	`generateRoles.data-user1` in `common/governance/roles.yaml`
IAM Role	`<org>-dev-govern1-roles-data-user2` `/<org>/govern1/generated-role/data-user2/id`	`generateRoles.data-user2` in `common/governance/roles.yaml`
IAM Role	`<org>-dev-govern1-roles-data-user3` `/<org>/govern1/generated-role/data-user3/id`	`generateRoles.data-user3` in `common/governance/roles.yaml`

Post-Deployment Steps

Upload Data

Only the <org>-dev-govern1-roles-data-admin role has write access to data lake buckets. All other roles are denied write operations.

Assume the data-admin role:

aws sts assume-role --role-arn arn:aws:iam::<account>:role/<org>-dev-govern1-roles-data-admin --role-session-name admin-session

Upload data to the appropriate zone bucket. Bucket naming pattern: <org>-dev-data1-datalake-<zone>

Zone	Bucket Pattern	Purpose
Raw	`<org>-dev-data1-datalake-raw`	Unprocessed source data
Transformed	`<org>-dev-data1-datalake-transformed`	Cleaned and normalized data
Curated	`<org>-dev-data1-datalake-curated`	Business-ready analytical data

Upload with KMS encryption:

aws s3 cp ./sample_data s3://<org>-dev-data1-datalake-transformed/data/sample_database1/ \
  --recursive --sse aws:kms --sse-kms-key-id <kms-key-id>

Find the KMS key ARN via SSM Parameter Store: /<org>/data1/datalake/kms/arn

Catalog Data

Assume the <org>-dev-govern1-roles-data-admin role and navigate to AWS Glue Console > Crawlers > select <org>-dev-dataops1-crawler1-crawler1.
Trigger the crawler and monitor CloudWatch Logs to confirm tables were created.
Verify tables appear under the <org>-dev-dataops1-project1-sample-database1 Glue database.

Access Data via DataZone

Assume a data-user role (e.g., <org>-dev-govern1-roles-data-user1, <org>-dev-govern1-roles-data-user2, <org>-dev-govern1-roles-data-user3).
Navigate to Amazon DataZone Console > Domains > select your domain > Open data portal.
Discover published data products, create subscriptions, and consume data.

Troubleshooting

Access Denied when uploading: Ensure you are using the <org>-dev-govern1-roles-data-admin role. Other roles do not have write permissions to the data lake buckets.
DataZone domain not accessible: Verify the IAM Identity Center users or groups listed in the DataZone configuration match your SSO identity. Check that the domain deployment completed successfully in CloudFormation.
Glue Crawler failures: Check CloudWatch Logs for the crawler execution. Common causes include missing LakeFormation permissions on the target S3 location or KMS key access issues.