Amazon Athena - Amazon Step Functions
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China.

Amazon Athena

These example templates show how Amazon Step Functions generates IAM policies based on the resources in your state machine definition. For more information, see:

StartQueryExecution

Static resources

Run a Job (.sync)
{ "Version": "2012-10-17", "Statement":[ { "Effect": "Allow", "Action": [ "athena:startQueryExecution", "athena:stopQueryExecution", "athena:getQueryExecution", "athena:getDataCatalog" ], "Resource": [ "arn:aws:athena:{{region}}:{{accountId}}:workgroup/[[workGroup]]", "arn:aws:athena:{{region}}:{{accountId}}:datacatalog/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:CreateTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:DeletePartition", "glue:BatchDeletePartition" ], "Resource": [ "arn:aws:glue:{{region}}:{{accountId}}:catalog", "arn:aws:glue:{{region}}:{{accountId}}:database/*", "arn:aws:glue:{{region}}:{{accountId}}:table/*", "arn:aws:glue:{{region}}:{{accountId}}:userDefinedFunction/*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] } ] }
Request Response
{ "Version": "2012-10-17", "Statement":[ { "Effect": "Allow", "Action": [ "athena:startQueryExecution", "athena:getDataCatalog" ], "Resource": [ "arn:aws:athena:{{region}}:{{accountId}}:workgroup/[[workGroup]]", "arn:aws:athena:{{region}}:{{accountId}}:datacatalog/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:CreateTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:DeletePartition", "glue:BatchDeletePartition" ], "Resource": [ "arn:aws:glue:{{region}}:{{accountId}}:catalog", "arn:aws:glue:{{region}}:{{accountId}}:database/*", "arn:aws:glue:{{region}}:{{accountId}}:table/*", "arn:aws:glue:{{region}}:{{accountId}}:userDefinedFunction/*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] } ] }

Dynamic resources

Run a Job (.sync)
{ "Version": "2012-10-17", "Statement":[ { "Effect": "Allow", "Action": [ "athena:startQueryExecution", "athena:stopQueryExecution", "athena:getQueryExecution", "athena:getDataCatalog" ], "Resource": [ "arn:aws:athena:{{region}}:{{accountId}}:workgroup/*", "arn:aws:athena:{{region}}:{{accountId}}:datacatalog/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:CreateTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:DeletePartition", "glue:BatchDeletePartition" ], "Resource": [ "arn:aws:glue:{{region}}:{{accountId}}:catalog", "arn:aws:glue:{{region}}:{{accountId}}:database/*", "arn:aws:glue:{{region}}:{{accountId}}:table/*", "arn:aws:glue:{{region}}:{{accountId}}:userDefinedFunction/*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] } ] }
Request Response
{ "Version": "2012-10-17", "Statement":[ { "Effect": "Allow", "Action": [ "athena:startQueryExecution", "athena:getDataCatalog" ], "Resource": [ "arn:aws:athena:{{region}}:{{accountId}}:workgroup/*", "arn:aws:athena:{{region}}:{{accountId}}:datacatalog/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:DeleteDatabase", "glue:CreateTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:DeletePartition", "glue:BatchDeletePartition" ], "Resource": [ "arn:aws:glue:{{region}}:{{accountId}}:catalog", "arn:aws:glue:{{region}}:{{accountId}}:database/*", "arn:aws:glue:{{region}}:{{accountId}}:table/*", "arn:aws:glue:{{region}}:{{accountId}}:userDefinedFunction/*" ] }, { "Effect": "Allow", "Action": [ "lakeformation:GetDataAccess" ], "Resource": [ "*" ] } ] }

StopQueryExecution

Resources

{ "Version": "2012-10-17", "Statement":[ { "Effect": "Allow", "Action": [ "athena:stopQueryExecution" ], "Resource": [ "arn:aws:athena:{{region}}:{{accountId}}:workgroup/*" ] } ] }

GetQueryExecution

Resources

{ "Version": "2012-10-17", "Statement":[ { "Effect": "Allow", "Action": [ "athena:getQueryExecution" ], "Resource": [ "arn:aws:athena:{{region}}:{{accountId}}:workgroup/*" ] } ] }

GetQueryResults

Resources

{ "Version": "2012-10-17", "Statement":[ { "Effect": "Allow", "Action": [ "athena:getQueryResults" ], "Resource": [ "arn:aws:athena:{{region}}:{{accountId}}:workgroup/*" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::*" ] } ] }