Skip to content
Docs

Amazon Athena

Connect Adverity Atlas to query data in S3 through AWS Athena and the Glue Data Catalog.

Prerequisites

A user or role that can read the data you want to query. Adverity Atlas only issues read queries against your tables, it does not create, modify, or drop them, so read access is all it needs.

Note

Athena is an exception to read-only access. AWS writes the result of every query to the S3 staging directory you configure below, so this identity also needs s3:PutObject and s3:GetObject on that location. That is an Athena requirement, not Adverity Atlas storing a copy of your data, your tables themselves are only ever read.

What Adverity Atlas reads

A sync lists the objects in each schema you bind and records what kind each one is. Profiling then runs aggregate queries over the types it can profile, and those field statistics are what Chat and the glossary work from. An object that is discovered but not profiled is still queryable, it just carries no statistics.

Object type

Discovered and queryable

Profiled

Tables

Yes

Yes

Views

Yes

No

Querying and profiling need the same access: read on the objects you want available, through the Glue catalog and the underlying S3 data. Profiling adds no privilege of its own, it reads the same objects with aggregate queries. The Connection test on the wizard’s Test step proves that access, in the order a sync needs it: connect, list the schemas, list the tables in the target schema, and read a row.

Authentication methods

Amazon Athena supports 3 authentication methods. Choose the one that matches your security posture.

IAM Role (default credential chain)

Use whichever AWS credentials the platform already has, env vars, instance profile, …

Best for: Adverity Atlas running inside AWS with an instance profile or pod role, no stored secrets.

No credentials are stored for this method.

Access Keys

Provide a static AWS access key id and secret.

Best for: Quick setup, or when Adverity Atlas runs outside AWS.

Credentials:

Field

Description

Access Key ID

e.g. AKIA...

Required

Secret Access Key

Stored encrypted.

Required

Session Token

Stored encrypted.

Optional

Assume Role (STS)

Assume an IAM role via STS, useful for cross-account access.

Best for: Cross-account access.

Credentials:

Field

Description

Role ARN

e.g. arn:aws:iam::123456789012:role/AthenaReader

Required

External ID

Optional

Setup

  1. Go to Settings > Data Governance > Data Sources. Under Add Connection, choose Amazon Athena. The Add a data source wizard opens and runs in five steps.

  2. Source, confirm Amazon Athena is selected and click Continue.

  3. Auth method, pick one of the methods above and click Continue.

  4. Authenticate, fill in the Configuration and Credentials fields and click Save credentials, then click Continue.

  5. Test, Adverity Atlas tests the connection as soon as you arrive and shows the result under Connection test. Continue unlocks once the test passes. After fixing a failure, click Test again. Back discards the saved credentials and returns you to Authenticate, with the configuration still filled in.

  6. Review & create, enter a Name, choose a Sync schedule, and pick a Mode: Active (sync runs on schedule and agents can query this source), Development (sync runs, but agents cannot query it yet), or Disabled (no automated operations). Then click Create data source.

The Connection test runs the full connection diagnostic: it authenticates, lists the visible schemas, lists the tables in the target schema, and reads a row. You cannot continue to Review & create until every check passes, so a wrong credential or a missing grant is resolved here rather than becoming an unhealthy source afterwards. A failed check reports the warehouse’s own error, and the grant that is missing where Adverity Atlas can work it out, see Connection diagnostics. A test that could not run at all says “The connection test could not run. Try again in a moment.”

Adverity Atlas verifies the connection as soon as the source is created, and starts the first sync when verification succeeds and the mode allows it. Schema discovery and field profiling run from that sync.

Tip

If someone else holds the credentials, use Share a one-time link under Or ask someone else on the Authenticate step. They submit the credentials through that link and see the connection test run on their page too. If it fails, Provide credentials again lets them correct what they entered. Your wizard moves on to Test once they submit, so the secret never passes through you.

Connection fields

These appear under Configuration on the wizard’s Authenticate step.

Field

Description

AWS Region

e.g. eu-west-1

Required

S3 Staging Directory

e.g. s3://my-bucket/athena-results/

Required

Catalog

e.g. AWSDataCatalog

Optional

Workgroup

e.g. primary

Optional

Troubleshooting

Symptom

Likely cause

“Unable to verify/create output bucket”

The S3 staging directory does not exist or the identity lacks s3:PutObject on it.

“Insufficient permissions to execute the query”

Missing Glue catalog read permissions (glue:GetTable, glue:GetPartitions).

Cross-account assume role fails

The target role’s trust policy does not allow the Adverity Atlas principal, or External ID does not match.

What’s next?

Was this page helpful?