Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions,
see Getting Started with Amazon Web Services in China
(PDF).
IAM policies for Amazon Athena calls in Step Functions
The following example templates show how Amazon Step Functions generates IAM policies based on the resources in your
state machine definition. For more information, see How Step Functions generates IAM policies for integrated
services and Discover service integration patterns in Step Functions.
StartQueryExecution
Static resources
- Run a Job (.sync)
-
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:startQueryExecution",
"athena:stopQueryExecution",
"athena:getQueryExecution",
"athena:getDataCatalog"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/[[workGroup]]",
"arn:aws:athena:{{region}}:{{accountId}}:datacatalog/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload",
"s3:CreateBucket",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*"
]
},
{
"Effect": "Allow",
"Action": [
"glue:CreateDatabase",
"glue:GetDatabase",
"glue:GetDatabases",
"glue:UpdateDatabase",
"glue:DeleteDatabase",
"glue:CreateTable",
"glue:UpdateTable",
"glue:GetTable",
"glue:GetTables",
"glue:DeleteTable",
"glue:BatchDeleteTable",
"glue:BatchCreatePartition",
"glue:CreatePartition",
"glue:UpdatePartition",
"glue:GetPartition",
"glue:GetPartitions",
"glue:BatchGetPartition",
"glue:DeletePartition",
"glue:BatchDeletePartition"
],
"Resource": [
"arn:aws:glue:{{region}}:{{accountId}}:catalog",
"arn:aws:glue:{{region}}:{{accountId}}:database/*",
"arn:aws:glue:{{region}}:{{accountId}}:table/*",
"arn:aws:glue:{{region}}:{{accountId}}:userDefinedFunction/*"
]
},
{
"Effect": "Allow",
"Action": [
"lakeformation:GetDataAccess"
],
"Resource": [
"*"
]
}
]
}
- Request Response
-
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:startQueryExecution",
"athena:getDataCatalog"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/[[workGroup]]",
"arn:aws:athena:{{region}}:{{accountId}}:datacatalog/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload",
"s3:CreateBucket",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*"
]
},
{
"Effect": "Allow",
"Action": [
"glue:CreateDatabase",
"glue:GetDatabase",
"glue:GetDatabases",
"glue:UpdateDatabase",
"glue:DeleteDatabase",
"glue:CreateTable",
"glue:UpdateTable",
"glue:GetTable",
"glue:GetTables",
"glue:DeleteTable",
"glue:BatchDeleteTable",
"glue:BatchCreatePartition",
"glue:CreatePartition",
"glue:UpdatePartition",
"glue:GetPartition",
"glue:GetPartitions",
"glue:BatchGetPartition",
"glue:DeletePartition",
"glue:BatchDeletePartition"
],
"Resource": [
"arn:aws:glue:{{region}}:{{accountId}}:catalog",
"arn:aws:glue:{{region}}:{{accountId}}:database/*",
"arn:aws:glue:{{region}}:{{accountId}}:table/*",
"arn:aws:glue:{{region}}:{{accountId}}:userDefinedFunction/*"
]
},
{
"Effect": "Allow",
"Action": [
"lakeformation:GetDataAccess"
],
"Resource": [
"*"
]
}
]
}
Dynamic resources
- Run a Job (.sync)
-
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:startQueryExecution",
"athena:stopQueryExecution",
"athena:getQueryExecution",
"athena:getDataCatalog"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/*",
"arn:aws:athena:{{region}}:{{accountId}}:datacatalog/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload",
"s3:CreateBucket",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*"
]
},
{
"Effect": "Allow",
"Action": [
"glue:CreateDatabase",
"glue:GetDatabase",
"glue:GetDatabases",
"glue:UpdateDatabase",
"glue:DeleteDatabase",
"glue:CreateTable",
"glue:UpdateTable",
"glue:GetTable",
"glue:GetTables",
"glue:DeleteTable",
"glue:BatchDeleteTable",
"glue:BatchCreatePartition",
"glue:CreatePartition",
"glue:UpdatePartition",
"glue:GetPartition",
"glue:GetPartitions",
"glue:BatchGetPartition",
"glue:DeletePartition",
"glue:BatchDeletePartition"
],
"Resource": [
"arn:aws:glue:{{region}}:{{accountId}}:catalog",
"arn:aws:glue:{{region}}:{{accountId}}:database/*",
"arn:aws:glue:{{region}}:{{accountId}}:table/*",
"arn:aws:glue:{{region}}:{{accountId}}:userDefinedFunction/*"
]
},
{
"Effect": "Allow",
"Action": [
"lakeformation:GetDataAccess"
],
"Resource": [
"*"
]
}
]
}
- Request Response
-
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:startQueryExecution",
"athena:getDataCatalog"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/*",
"arn:aws:athena:{{region}}:{{accountId}}:datacatalog/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload",
"s3:CreateBucket",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*"
]
},
{
"Effect": "Allow",
"Action": [
"glue:CreateDatabase",
"glue:GetDatabase",
"glue:GetDatabases",
"glue:UpdateDatabase",
"glue:DeleteDatabase",
"glue:CreateTable",
"glue:UpdateTable",
"glue:GetTable",
"glue:GetTables",
"glue:DeleteTable",
"glue:BatchDeleteTable",
"glue:BatchCreatePartition",
"glue:CreatePartition",
"glue:UpdatePartition",
"glue:GetPartition",
"glue:GetPartitions",
"glue:BatchGetPartition",
"glue:DeletePartition",
"glue:BatchDeletePartition"
],
"Resource": [
"arn:aws:glue:{{region}}:{{accountId}}:catalog",
"arn:aws:glue:{{region}}:{{accountId}}:database/*",
"arn:aws:glue:{{region}}:{{accountId}}:table/*",
"arn:aws:glue:{{region}}:{{accountId}}:userDefinedFunction/*"
]
},
{
"Effect": "Allow",
"Action": [
"lakeformation:GetDataAccess"
],
"Resource": [
"*"
]
}
]
}
StopQueryExecution
Resources
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:stopQueryExecution"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/*"
]
}
]
}
GetQueryExecution
Resources
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:getQueryExecution"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/*"
]
}
]
}
GetQueryResults
Resources
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:getQueryResults"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::*"
]
}
]
}