TheArchitect

Data Lake

AWS architecture template · SAA-C03: S3 raw zone + KMS encryption → Athena WorkGroup → S3 processed zone

Data Lake is a free AWS architecture template built with S3, Athena, CloudWatch, IAM and KMS. Open it in TheArchitect to edit the diagram, estimate monthly cost, and export the CloudFormation or Terraform that deploys it.

Open in TheArchitect All templates
KMSRaw ZoneAthena WorkGro…Processed ZoneAthena RoleScan Cost Alarm
Data Lake architecture diagram

AWS services in this template

  • S3×2
  • Athena
  • CloudWatch
  • IAM
  • KMS

Deployment notes

Needs input

  • Needs an Athena execution IAM role trust policy before the template is deploy-ready.
  • Generates two S3 buckets (raw + processed), a KMS key, an Athena WorkGroup, and a CloudWatch alarm.

Generated CloudFormation — 6 resources

Logical IDResource type
KMSkmsAWS::KMS::Key
RawZones3AWS::S3::Bucket
AthenaWorkGroupathenaAWS::Athena::WorkGroup
ProcessedZones3AWS::S3::Bucket
AthenaRoleiamAWS::IAM::Role
ScanCostAlarmcloudwatchAWS::CloudWatch::Alarm
View the full CloudFormation template
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Generated by TheArchitect — https://www.thecloudarchitect.dev",
  "Metadata": {
    "TheArchitect": {
      "Edges": [
        {
          "From": "KMSkms",
          "To": "RawZones3",
          "Label": "encrypt"
        },
        {
          "From": "RawZones3",
          "To": "AthenaWorkGroupathena",
          "Label": "query"
        },
        {
          "From": "AthenaRoleiam",
          "To": "AthenaWorkGroupathena",
          "Label": "role"
        },
        {
          "From": "AthenaWorkGroupathena",
          "To": "ProcessedZones3",
          "Label": "results"
        }
      ]
    }
  },
  "Resources": {
    "KMSkms": {
      "Type": "AWS::KMS::Key",
      "Properties": {
        "Description": "KMS key for data lake S3 server-side encryption.",
        "KeySpec": "SYMMETRIC_DEFAULT",
        "KeyUsage": "ENCRYPT_DECRYPT",
        "EnableKeyRotation": true,
        "Enabled": true
      }
    },
    "RawZones3": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "BucketName": "saa-datalake-raw",
        "VersioningConfiguration": {
          "Status": "Enabled"
        },
        "OwnershipControls": {
          "Rules": [
            {
              "ObjectOwnership": "BucketOwnerEnforced"
            }
          ]
        },
        "BucketEncryption": {
          "ServerSideEncryptionConfiguration": [
            {
              "ServerSideEncryptionByDefault": {
                "SSEAlgorithm": "aws:kms"
              }
            }
          ]
        },
        "PublicAccessBlockConfiguration": {
          "BlockPublicAcls": true,
          "BlockPublicPolicy": true,
          "IgnorePublicAcls": true,
          "RestrictPublicBuckets": true
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "saa-datalake-raw"
          }
        ]
      }
    },
    "AthenaWorkGroupathena": {
      "Type": "AWS::Athena::WorkGroup",
      "DependsOn": [
        "AthenaRoleiam"
      ],
      "Properties": {
        "Name": "saa-datalake-workgroup",
        "Description": "Athena WorkGroup for data lake queries.",
        "State": "ENABLED",
        "WorkGroupConfiguration": {
          "EnforceWorkGroupConfiguration": true,
          "PublishCloudWatchMetricsEnabled": true,
          "ResultConfiguration": {
            "OutputLocation": "s3://saa-datalake-processed/athena-results/"
          }
        }
      }
    },
    "ProcessedZones3": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "BucketName": "saa-datalake-processed",
        "VersioningConfiguration": {
          "Status": "Enabled"
        },
        "OwnershipControls": {
          "Rules": [
            {
              "ObjectOwnership": "BucketOwnerEnforced"
            }
          ]
        },
        "BucketEncryption": {
          "ServerSideEncryptionConfiguration": [
            {
              "ServerSideEncryptionByDefault": {
                "SSEAlgorithm": "AES256"
              }
            }
          ]
        },
        "PublicAccessBlockConfiguration": {
          "BlockPublicAcls": true,
          "BlockPublicPolicy": true,
          "IgnorePublicAcls": true,
          "RestrictPublicBuckets": true
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "saa-datalake-processed"
          }
        ]
      }
    },
    "AthenaRoleiam": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "RoleName": "saa-datalake-athena-role",
        "Description": "IAM role for Athena query execution and S3 access."
      }
    },
    "ScanCostAlarmcloudwatch": {
      "Type": "AWS::CloudWatch::Alarm",
      "Properties": {
        "AlarmName": "saa-datalake-scan-cost",
        "AlarmDescription": "Alert when Athena bytes scanned exceeds 100 GB in one hour.",
        "Namespace": "AWS/Athena",
        "MetricName": "ProcessedBytes",
        "Statistic": "Sum",
        "Period": 3600,
        "EvaluationPeriods": 1,
        "Threshold": 107374182400,
        "ComparisonOperator": "GreaterThanOrEqualToThreshold",
        "TreatMissingData": "notBreaching"
      }
    }
  }
}

Generated by TheArchitect from the diagram above. Review values such as names, CIDR ranges and instance sizes before deploying to your account.

Related templates