Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Athena

Integrating Amazon Athena with Upriver

Amazon Athena is a serverless, interactive query service provided by Amazon Web Services (AWS) that allows you to analyze data stored in Amazon S3 using standard SQL. By integrating Athena with Upriver, you can enhance data governance and maintain high data quality across your data lake. This integration enables efficient data monitoring, traceability, and consistency, ensuring that queries and analytics built on your S3 datasets remain accurate and reliable without requiring infrastructure management.

Configure the Athena integration in the Upriver's Platform

The integration is configured per catalog. The CloudFormation stack does not need to be redeployed for each catalog, but must be updated whenever the list of monitored S3 buckets changes.

In the Upriver app, navigate to Settings->Data Integrations , click "+ Add" in the top-right corner.

Step 1: Name and type

  • Name - A user defined name for the integration.

  • Type - Select Athena integration type.

Step 2: Deploy CloudFormation

The CloudFormation stack must be deployed or updated whenever the list of monitored S3 buckets changes.

What should you do?

First time connecting? ↓ Download and deploy the CloudFormation template

Updating monitored buckets? ↓ Update the existing stack in AWS CloudFormation

If you already deployed this stack before and only want to add or remove buckets, update the existing stack instead of deploying a new one.

Step a: Deploy or Update CloudFormation

Deploy the provided CloudFormation template in your AWS account.

First-time setup - Download the CloudFormation template and deploy it as a new stack.

upriver_athena_saas_provisioning.yml
8KB
Open

Updating bucket access - If the stack already exists:

Open AWS CloudFormation Select the existing Upriver stack Click Update stack Update the relevant parameters

Enter the required parameters:

  • ExistingUpriverAccessRoleName (optional) Existing Upriver access role name for this AWS account (only available if already ran another CloudFormation stack)

  • OriginTablesBucketArns

    S3 bucket ARNs for table data locations (read-only). Include both bucket and object ARNs, same pattern as query results. Example:

  • QueryResultBucketArns S3 bucket ARNs for query results. Make sure to include both bucket and its content. Example:

Step b: Copy outputs

Copy Upriver access role from the stack outputs to enter in the next step.

Step 3: Lake Formation grants

Complete this step only if Lake Formation governs access to the Glue Data Catalog or underlying tables.

If your AWS account uses Lake Formation for data access control, the Upriver role also needs Lake Formation grants.

CloudFormation does not support wildcard Lake Formation grants across all databases. Your Lake Formation admin must grant these permissions manually for each database that Upriver needs to access:

  • DESCRIBE on the database

  • SELECT and DESCRIBE on all tables in the database

Set the role ARN from the CloudFormation stack outputs:

Then run the following commands for each database, make sure to:

  • ROLE_ARN - UpriverAccessRoleArn recieved from the CloudFormation stack outputs

  • DATABASE_NAME_FOR_UPRIVER - Replace <DATABSE_NAME> to the desired database

  • REGION_FOR_UPRIVER - Replace <REGION> to the matching region

grant-permissions command require that the CloudFormation deployer (the IAM principal executing the stack) has Lake Formation administrator rights or the necessary grant permissions (WITH GRANT OPTION) on those databases/tables.

Step 4: Finalize the integration

Copy the CloudFormation output values and enter them in the next step of the integration wizard:

  • AthenaCatalog Athena catalog name of the catalog id used for GlueCatalogId

  • AthenaWorkGroup

    The name of the workgroup to use for queries (it is recommended to create a dedicated workgroup).

  • AthenaQueryResultBucketPath

    S3 URI to query result (from CloudFormation output)

  • UpriverAccessRoleArn

    Upriver role with required permissions (from CloudFormation output). Example: arn:aws:iam::<AWSAccountID>:role/upriver-access-role

Athena workgroups expose a "override client-side settings" configuration flag. If set, it will cause Athena to use the workgroup's query results location regardless of the client request. To mitigate this Upriver recommends setting up a dedicated workgroup for its queries, with the query result path of that workgroup set to match the path described by QueryResultBucketArns from Step 2: Deploy CloudFormation.

Required Permissions

The CloudFormation template creates an IAM role that grants Upriver the permissions required to query Athena and read metadata from the AWS Glue Data Catalog.

If Lake Formation governs access in your environment, that IAM role also needs Lake Formation GetDataAccess permission and specific database grants as specified in the terraform template and in Step 3: Lake Formation grants.

These permissions allow Upriver to:

  • Execute and monitor Athena queries

  • Retrieve query results

  • Access Athena workgroups and data catalogs

  • Read database and table metadata from the AWS Glue Data Catalog

  • Access partitions and table versions

  • Read and write Athena query results in the configured S3 results bucket

  • Access Lake Formation-governed databases and tables when manual Lake Formation grants are applied

Additionally, the role includes S3 permissions that allow Athena query results to be written to and retrieved from the configured results bucket.

PreviousS3
NextRedshift

Last updated