Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Athena

Amazon Athena (service prefix: athena) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by Amazon Athena

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
BatchGetNamedQuery	athena:BatchGetNamedQuery			Read
BatchGetPreparedStatement	athena:BatchGetPreparedStatement			Read
BatchGetQueryExecution	athena:BatchGetQueryExecution			Read
CancelCapacityReservation	athena:CancelCapacityReservation			Write
CreateCapacityReservation	athena:CreateCapacityReservation			Write
CreateCapacityReservation	athena:TagResource			Tagging, Write
CreateDataCatalog	athena:CreateDataCatalog			Write
CreateDataCatalog	athena:TagResource			Tagging, Write
CreateNamedQuery	athena:CreateNamedQuery			Write
CreateNotebook	athena:CreateNotebook			Write
CreatePreparedStatement	athena:CreatePreparedStatement			Write
CreatePresignedNotebookUrl	athena:CreatePresignedNotebookUrl			Write
CreateWorkGroup	athena:CreateWorkGroup			Write
	athena:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	athena.amazonaws.com	Write
DeleteCapacityReservation	athena:DeleteCapacityReservation			Write
DeleteDataCatalog	athena:DeleteDataCatalog			Write
DeleteNamedQuery	athena:DeleteNamedQuery			Write
DeleteNotebook	athena:DeleteNotebook			Write
DeletePreparedStatement	athena:DeletePreparedStatement			Write
DeleteWorkGroup	athena:DeleteWorkGroup			Write
ExportNotebook	athena:ExportNotebook			Write
GetCalculationExecution	athena:GetCalculationExecution			Read
GetCalculationExecutionCode	athena:GetCalculationExecutionCode			Read
GetCalculationExecutionStatus	athena:GetCalculationExecutionStatus			Read
GetCapacityAssignmentConfiguration	athena:GetCapacityAssignmentConfiguration			Read
GetCapacityReservation	athena:GetCapacityReservation			Read
GetDataCatalog	athena:GetDataCatalog			Read
GetDatabase	athena:GetDatabase			Read
GetNamedQuery	athena:GetNamedQuery			Read
GetNotebookMetadata	athena:GetNotebookMetadata			Read
GetPreparedStatement	athena:GetPreparedStatement			Read
GetQueryExecution	athena:GetQueryExecution			Read
GetQueryResults	athena:GetQueryResults			Read
GetQueryRuntimeStatistics	athena:GetQueryRuntimeStatistics			Read
GetResourceDashboard	athena:GetResourceDashboard			Read
GetSession	athena:GetSession			Read
GetSessionEndpoint	athena:GetSessionEndpoint			Write
GetSessionStatus	athena:GetSessionStatus			Read
GetTableMetadata	athena:GetTableMetadata			Read
GetWorkGroup	athena:GetWorkGroup			Read
ImportNotebook	athena:ImportNotebook			Write
ListApplicationDPUSizes	athena:ListApplicationDPUSizes			List
ListCalculationExecutions	athena:ListCalculationExecutions			List
ListCapacityReservations	athena:ListCapacityReservations			List
ListDataCatalogs	athena:ListDataCatalogs			List
ListDatabases	athena:ListDatabases			List
ListEngineVersions	athena:ListEngineVersions			Read
ListExecutors	athena:ListExecutors			List
ListNamedQueries	athena:ListNamedQueries			List
ListNotebookMetadata	athena:ListNotebookMetadata			List
ListNotebookSessions	athena:ListNotebookSessions			List
ListPreparedStatements	athena:ListPreparedStatements			List
ListQueryExecutions	athena:ListQueryExecutions			Read
ListSessions	athena:ListSessions			List
ListTableMetadata	athena:ListTableMetadata			Read
ListTagsForResource	athena:ListTagsForResource			Read
ListWorkGroups	athena:ListWorkGroups			List
PutCapacityAssignmentConfiguration	athena:PutCapacityAssignmentConfiguration			Write
StartCalculationExecution	athena:StartCalculationExecution			Write
StartQueryExecution	athena:StartQueryExecution			Write
StartSession	athena:ListTagsForResource			Read
	athena:StartSession			Write
	athena:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	athena.amazonaws.com	Write
StopCalculationExecution	athena:StopCalculationExecution			Write
StopQueryExecution	athena:StopQueryExecution			Write
TagResource	athena:TagResource			Tagging, Write
TerminateSession	athena:TerminateSession			Write
UntagResource	athena:UntagResource			Tagging, Write
UpdateCapacityReservation	athena:UpdateCapacityReservation			Write
UpdateDataCatalog	athena:UpdateDataCatalog			Write
UpdateNamedQuery	athena:UpdateNamedQuery			Write
UpdateNotebook	athena:UpdateNotebook			Write
UpdateNotebookMetadata	athena:UpdateNotebookMetadata			Write
UpdatePreparedStatement	athena:UpdatePreparedStatement			Write
UpdateWorkGroup	athena:UpdateWorkGroup			Write
UpdateWorkGroup	iam:PassRole	iam:PassedToService	athena.amazonaws.com	Write

Actions defined by Amazon Athena

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchGetNamedQuery	Grants permission to get information about one or more named queries	workgroup*	aws:ResourceTag/${TagKey}	Read
BatchGetPreparedStatement	Grants permission to get information about one or more prepared statements	workgroup*	aws:ResourceTag/${TagKey}	Read
BatchGetQueryExecution	Grants permission to get information about one or more query executions	workgroup*	aws:ResourceTag/${TagKey}	Read
CancelCapacityReservation	Grants permission to cancel a capacity reservation	capacity-reservation*	aws:ResourceTag/${TagKey}	Write
CancelQueryExecution	Grants permission to cancel query execution. Deprecated. Applies only to Amazon services and principals that use Athena JDBC driver earlier than 1.1.0. Use StopQueryExecution otherwise	workgroup*	aws:ResourceTag/${TagKey}	Write
CreateCapacityReservation	Grants permission to create a capacity reservation	capacity-reservation*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDataCatalog	Grants permission to create a datacatalog	datacatalog*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateNamedQuery	Grants permission to create a named query	workgroup*	aws:ResourceTag/${TagKey}	Write
CreateNotebook	Grants permission to create a notebook	workgroup*	aws:ResourceTag/${TagKey}	Write
CreatePreparedStatement	Grants permission to create a prepared statement	workgroup*	aws:ResourceTag/${TagKey}	Write
CreatePresignedNotebookUrl	Grants permission to create a presigned notebook url	workgroup*	aws:ResourceTag/${TagKey}	Write
CreateWorkGroup	Grants permission to create a workgroup	workgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteCapacityReservation	Grants permission to delete a capacity reservation	capacity-reservation*	aws:ResourceTag/${TagKey}	Write
DeleteDataCatalog	Grants permission to delete a datacatalog	datacatalog*	aws:ResourceTag/${TagKey}	Write
DeleteNamedQuery	Grants permission to delete a named query specified	workgroup*	aws:ResourceTag/${TagKey}	Write
DeleteNotebook	Grants permission to delete a notebook	workgroup*	aws:ResourceTag/${TagKey}	Write
DeletePreparedStatement	Grants permission to delete a prepared statement specified	workgroup*	aws:ResourceTag/${TagKey}	Write
DeleteWorkGroup	Grants permission to delete a workgroup	workgroup*	aws:ResourceTag/${TagKey}	Write
ExportNotebook	Grants permission to export a notebook	workgroup*	aws:ResourceTag/${TagKey}	Write
GetCalculationExecution	Grants permission to get a calculation execution	workgroup*	aws:ResourceTag/${TagKey}	Read
GetCalculationExecutionCode	Grants permission to get a calculation execution code	workgroup*	aws:ResourceTag/${TagKey}	Read
GetCalculationExecutionStatus	Grants permission to get a calculation execution status	workgroup*	aws:ResourceTag/${TagKey}	Read
GetCapacityAssignmentConfiguration	Grants permission to get capacity assignment information for a capacity reservation	capacity-reservation*	aws:ResourceTag/${TagKey}	Read
GetCapacityReservation	Grants permission to get a capacity reservation	capacity-reservation*	aws:ResourceTag/${TagKey}	Read
GetCatalogs	Grants permission to enable access to databases and tables. Applies only to Amazon services managed policy and principals that use an Athena JDBC driver version 1.1.0			Read
GetDataCatalog	Grants permission to get a datacatalog	datacatalog*	aws:ResourceTag/${TagKey}	Read
GetDatabase	Grants permission to get a database for a given datacatalog	datacatalog*	aws:ResourceTag/${TagKey}	Read
GetExecutionEngine	Grants permission to enable access to the specified database and table. Applies only to Amazon services managed policy and principals that use an Athena JDBC driver version 1.1.0			Read
GetExecutionEngines	Grants permission to enable access to databases and tables. Applies only to Amazon services managed policy and principals that use an Athena JDBC driver version 1.1.0			Read
GetNamedQuery	Grants permission to get information about the specified named query	workgroup*	aws:ResourceTag/${TagKey}	Read
GetNamespace	Grants permission to enable access to the specified database and table. Applies only to Amazon services managed policy and principals that use an Athena JDBC driver version 1.1.0			Read
GetNamespaces	Grants permission to enable access to databases and tables. Applies only to Amazon services managed policy and principals that use an Athena JDBC driver version 1.1.0			Read
GetNotebookMetadata	Grants permission to get notebook metadata	workgroup*	aws:ResourceTag/${TagKey}	Read
GetPreparedStatement	Grants permission to get information about the specified prepared statement	workgroup*	aws:ResourceTag/${TagKey}	Read
GetQueryExecution	Grants permission to get information about the specified query execution	workgroup*	aws:ResourceTag/${TagKey}	Read
GetQueryExecutions	Grants permission to get query executions. Deprecated. Applies only to Amazon services and principals that use Athena JDBC driver earlier than 1.1.0. Use ListQueryExecutions otherwise			Read
GetQueryResults	Grants permission to get the query results	workgroup*	aws:ResourceTag/${TagKey}	Read
GetQueryResultsStream	Grants permission to get the query results stream	workgroup*	aws:ResourceTag/${TagKey}	Read
GetQueryRuntimeStatistics	Grants permission to get runtime statistics for the specified query execution	workgroup*	aws:ResourceTag/${TagKey}	Read
GetResourceDashboard	Grants permission to get a Live UI/Persistence UI for a session	session	aws:ResourceTag/${TagKey}	Read
GetResourceDashboard		workgroup*	aws:ResourceTag/${TagKey}	Read
GetSession	Grants permission to get a session	session	aws:ResourceTag/${TagKey}	Read
GetSession	Grants permission to get a session	workgroup*	aws:ResourceTag/${TagKey}	Read
GetSessionEndpoint	Grants permission to get a connection endpoint and authentication token for a given session Id	session	aws:ResourceTag/${TagKey}	Write
GetSessionEndpoint		workgroup*	aws:ResourceTag/${TagKey}	Write
GetSessionStatus	Grants permission to get a session status	session	aws:ResourceTag/${TagKey}	Read
GetSessionStatus	Grants permission to get a session status	workgroup*	aws:ResourceTag/${TagKey}	Read
GetTable	Grants permission to enable access to the specified table. Applies only to Amazon services managed policy and principals that use an Athena JDBC driver version 1.1.0			Read
GetTableMetadata	Grants permission to get a metadata about a table for a given datacatalog	datacatalog*	aws:ResourceTag/${TagKey}	Read
GetTables	Grants permission to enable access to tables. Applies only to Amazon services managed policy and principals that use an Athena JDBC driver version 1.1.0			Read
GetWorkGroup	Grants permission to get a workgroup	workgroup*	aws:ResourceTag/${TagKey}	Read
ImportNotebook	Grants permission to import a notebook	workgroup*	aws:ResourceTag/${TagKey}	Write
ListApplicationDPUSizes	Grants permission to return a list of ApplicationRuntimeIds			List
ListCalculationExecutions	Grants permission to return a list of calculation executions	workgroup*	aws:ResourceTag/${TagKey}	List
ListCapacityReservations	Grants permission to return a list of capacity reservations for the specified Amazon Web Services account			List
ListDataCatalogs	Grants permission to return a list of datacatalogs for the specified Amazon Web Services account			List
ListDatabases	Grants permission to return a list of databases for a given datacatalog	datacatalog*	aws:ResourceTag/${TagKey}	List
ListEngineVersions	Grants permission to return a list of athena engine versions for the specified Amazon Web Services account			Read
ListExecutors	Grants permission to return a list of executors			List
ListNamedQueries	Grants permission to return a list of named queries in Amazon Athena for the specified Amazon Web Services account	workgroup*	aws:ResourceTag/${TagKey}	List
ListNotebookMetadata	Grants permission to return a list of notebooks for a given workgroup	workgroup*	aws:ResourceTag/${TagKey}	List
ListNotebookSessions	Grants permission to return a list of sessions for a given notebook	workgroup*	aws:ResourceTag/${TagKey}	List
ListPreparedStatements	Grants permission to return a list of prepared statements for the specified workgroup	workgroup*	aws:ResourceTag/${TagKey}	List
ListQueryExecutions	Grants permission to return a list of query executions for the specified Amazon Web Services account	workgroup*	aws:ResourceTag/${TagKey}	Read
ListSessions	Grants permission to return a list of sessions for a given workgroup	workgroup*	aws:ResourceTag/${TagKey}	List
ListTableMetadata	Grants permission to return a list of table metadata in a database for a given datacatalog	datacatalog*	aws:ResourceTag/${TagKey}	Read
ListTagsForResource	Grants permission to return a list of tags for a resource	capacity-reservation*	aws:ResourceTag/${TagKey}	Read
		datacatalog*	aws:ResourceTag/${TagKey}
		session*	aws:ResourceTag/${TagKey}
		workgroup*	aws:ResourceTag/${TagKey}
ListWorkGroups	Grants permission to return a list of workgroups for the specified Amazon Web Services account			List
PutCapacityAssignmentConfiguration	Grants permission to assign capacity from a capacity reservation to queries	capacity-reservation*	aws:ResourceTag/${TagKey}	Write
PutCapacityAssignmentConfiguration		workgroup*	aws:ResourceTag/${TagKey}	Write
RunQuery	Grants permission to run a query. Deprecated. Applies only to Amazon services and principals that use Athena JDBC driver earlier than 1.1.0. Use StartQueryExecution otherwise			Write
StartCalculationExecution	Grants permission to start a calculation execution	workgroup*	aws:ResourceTag/${TagKey}	Write
StartQueryExecution	Grants permission to start a query execution using an SQL query provided as a string	workgroup*	aws:ResourceTag/${TagKey}	Write
StartSession	Grants permission to start a session	session	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
StartSession	Grants permission to start a session	workgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
StopCalculationExecution	Grants permission to stop a calculation execution	workgroup*	aws:ResourceTag/${TagKey}	Write
StopQueryExecution	Grants permission to stop the specified query execution	workgroup*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add a tag to a resource	capacity-reservation*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		datacatalog*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		session*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		workgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
TerminateSession	Grants permission to terminate a session	session	aws:ResourceTag/${TagKey}	Write
TerminateSession	Grants permission to terminate a session	workgroup*	aws:ResourceTag/${TagKey}	Write
UntagResource	Grants permission to remove a tag from a resource	capacity-reservation*	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		datacatalog*	aws:ResourceTag/${TagKey} aws:TagKeys
		session*	aws:ResourceTag/${TagKey} aws:TagKeys
		workgroup*	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateCapacityReservation	Grants permission to update a capacity reservation	capacity-reservation*	aws:ResourceTag/${TagKey}	Write
UpdateDataCatalog	Grants permission to update a datacatalog	datacatalog*	aws:ResourceTag/${TagKey}	Write
UpdateNamedQuery	Grants permission to update a named query specified	workgroup*	aws:ResourceTag/${TagKey}	Write
UpdateNotebook	Grants permission to update a notebook	workgroup*	aws:ResourceTag/${TagKey}	Write
UpdateNotebookMetadata	Grants permission to update notebook metadata	workgroup*	aws:ResourceTag/${TagKey}	Write
UpdatePreparedStatement	Grants permission to update a prepared statement	workgroup*	aws:ResourceTag/${TagKey}	Write
UpdateWorkGroup	Grants permission to update a workgroup	workgroup*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Athena

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
capacity-reservation	arn:${Partition}:athena:${Region}:${Account}:capacity-reservation/${CapacityReservationName}	aws:ResourceTag/${TagKey}
datacatalog	arn:${Partition}:athena:${Region}:${Account}:datacatalog/${DataCatalogName}	aws:ResourceTag/${TagKey}
session	arn:${Partition}:athena:${Region}:${Account}:workgroup/${WorkGroupName}/session/${SessionId}	aws:ResourceTag/${TagKey}
workgroup	arn:${Partition}:athena:${Region}:${Account}:workgroup/${WorkGroupName}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Athena

Amazon Athena defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the the presence of tag keys in the request	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Application Recovery Controller - Zonal Shift (arc-zonal-shift)

Amazon CloudFront (cloudfront)