Configure access to system tables

System tables add the system-table resource type, with the ARN arn:{partition}:athena:{region}:{account}:system-table/{tableName}. They also add five actions: athena:CreateSystemTableConfiguration, athena:UpdateSystemTableConfiguration, athena:DeleteSystemTableConfiguration, athena:GetSystemTableConfiguration, and athena:ListSystemTableStatuses. Grant the permissions to manage system tables separately from the permissions to query them. For least-privilege example policies, see IAM permissions.

When you enable system tables, the Athena system tables service principal (systemtables.athena.amazonaws.com) writes query history to the aws-athena Amazon S3 Tables bucket in your account. The bucket policy that S3 Tables attaches grants access only to that service principal, and only for requests made on behalf of your account (aws:SourceAccount). S3 Tables denies writes to system tables from all principals in your account. You can read and delete system tables, but you can't modify their data.