Amazon Athena
User Guide

IAM Policies for Accessing Workgroups

To control access to workgroups, use resource-level IAM permissions or identity-based IAM policies.

The following procedure is specific to Athena.

For IAM-specific information, see the links listed at the end of this section. For information about example JSON workgroup policies, see Workgroup Example Policies.

To use the visual editor in the IAM console to create a workgroup policy

  1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

  2. In the navigation pane on the left, choose Policies, and then choose Create policy.

  3. On the Visual editor tab, choose Choose a service. Then choose Athena to add to the policy.

  4. Choose Select actions, and then choose the actions to add to the policy. The visual editor shows the actions available in Athena. For more information, see Actions, Resources, and Condition Keys for Amazon Athena in the IAM User Guide.

  5. Choose add actions to type a specific action or use wildcards (*) to specify multiple actions.

    By default, the policy that you are creating allows the actions that you choose. If you chose one or more actions that support resource-level permissions to the workgroup resource in Athena, then the editor lists the workgroup resource.

  6. Choose Resources to specify the specific workgroups for your policy. For example JSON workgroup policies, see Workgroup Example Policies.

  7. Specify the workgroup resource as follows:

    arn:aws:athena:<region>:<user-account>:workgroup/<workgroup-name>
  8. Choose Review policy, and then type a Name and a Description (optional) for the policy that you are creating. Review the policy summary to make sure that you granted the intended permissions.

  9. Choose Create policy to save your new policy.

  10. Attach the policy to your groups, users, or roles.

    In an identity-based policy, attach the policy to an identity and specify the workgroup resources that a user, a group, or role can access. In a resource-based policy, attach a policy to the workgroup resource that you want to control. In the policy, specify which principals can access that resource.

For more information, see the following topics in the IAM User Guide:

For example JSON workgroup policies, see Workgroup Example Policies.

For a complete list of Amazon Athena actions, see the API action names in the Amazon Athena API Reference.