S3でデータレイクを構築する

データレイクとは

データレイクゾーンのアーキテクチャ

# Example zone structure inside one S3 bucket
# s3://my-data-lake/
#   landing/    <- raw ingest from source systems
#   processing/ <- cleansed, validated data
#   curated/    <- aggregated, analytics-ready

S3 バケット構造の作成

aws s3api create-bucket \
  --bucket my-data-lake-123 \
  --region us-east-1

aws s3api put-bucket-versioning \
  --bucket my-data-lake-123 \
  --versioning-configuration Status=Enabled

aws s3api put-bucket-encryption \
  --bucket my-data-lake-123 \
  --server-side-encryption-configuration \
    '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}'

ゾーンアクセス用のバケットポリシーの適用

# Attach a policy that allows the ETL role to read landing/ and write processing/
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::123456789012:role/ETLRole"},
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-data-lake-123/landing/*"
    },
    {
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::123456789012:role/ETLRole"},
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-data-lake-123/processing/*"
    }
  ]
}

クエリ効率を高めるデータのパーティショニング

# Hive-style partition naming for year/month/day
# s3://my-data-lake-123/curated/sales/
#   year=2024/month=01/day=15/part-00000.parquet
#   year=2024/month=01/day=16/part-00000.parquet
#   year=2024/month=02/day=01/part-00000.parquet

# Athena recognises this naming automatically

列指向フォーマット：Parquet と ORC

# Converting CSV to Parquet with AWS Glue (simplified PySpark)
import sys
from awsglue.context import GlueContext
from pyspark.context import SparkContext

sc = SparkContext()
glueContext = GlueContext(sc)

datasource = glueContext.create_dynamic_frame.from_catalog(
    database='my_db', table_name='raw_sales')

glueContext.write_dynamic_frame.from_options(
    frame=datasource,
    connection_type='s3',
    connection_options={'path': 's3://my-data-lake-123/curated/sales/'},
    format='parquet')

コスト管理のための S3 ライフサイクルポリシー

aws s3api put-bucket-lifecycle-configuration \
  --bucket my-data-lake-123 \
  --lifecycle-configuration '{
    "Rules": [{
      "ID": "ArchiveLanding",
      "Filter": {"Prefix": "landing/"},
      "Status": "Enabled",
      "Transitions": [
        {"Days": 30, "StorageClass": "GLACIER_IR"},
        {"Days": 90, "StorageClass": "DEEP_ARCHIVE"}
      ]
    }]
  }'

きめ細かなアクセス制御のための Lake Formation

# Grant Lake Formation table access via CLI
aws lakeformation grant-permissions \
  --principal DataLakePrincipalIdentifier=arn:aws:iam::123456789012:role/AnalystRole \
  --permissions SELECT \
  --resource '{
    "Table": {
      "DatabaseName": "my_db",
      "Name": "curated_sales"
    }
  }'

取り込みトリガー用の S3 イベント通知

# S3 event notification to trigger Lambda on new object
aws s3api put-bucket-notification-configuration \
  --bucket my-data-lake-123 \
  --notification-configuration '{
    "LambdaFunctionConfigurations": [{
      "LambdaFunctionArn": "arn:aws:lambda:us-east-1:123456789012:function:ProcessNewFile",
      "Events": ["s3:ObjectCreated:*"],
      "Filter": {
        "Key": {"FilterRules": [{"Name": "prefix", "Value": "landing/"}]}
      }
    }]
  }'

データレイクにおける暗号化とコンプライアンス

# Enforce KMS encryption on all PUT operations via bucket policy
{
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::my-data-lake-123/curated/*",
  "Condition": {
    "StringNotEquals": {
      "s3:x-amz-server-side-encryption": "aws:kms"
    }
  }
}

クロスアカウントのデータレイクアクセス

# Bucket policy in central account allows consumer account to read curated/
{
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::999988887777:root"
  },
  "Action": ["s3:GetObject", "s3:ListBucket"],
  "Resource": [
    "arn:aws:s3:::my-data-lake-123",
    "arn:aws:s3:::my-data-lake-123/curated/*"
  ]
}

クイックチェック

レッスンのまとめ