IAM / analytics / athena

AWS Athena (IAM)

JSON →

AWSathenaanalytics

An interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL.

iamaws

docs ↗

Permissions

Actions in this service

athena:GetQueryExecution

athena:GetQueryResults

athena:RunQuery

athena:GetWorkGroup

athena:ListWorkGroups

athena:GetDataCatalog

athena:ListDataCatalogs

Policy

Minimal privilege example

Copy-paste least-privilege policy statement — not yet harness-verified.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "athena:GetQueryExecution", "athena:GetQueryResults", "athena:RunQuery", "athena:GetWorkGroup", "athena:ListWorkGroups", "athena:GetDataCatalog", "athena:ListDataCatalogs" ], "Resource": "*" } ] }

SDK mapping

Method → permission

SDK method mapping (e.g. boto3.get_object() → s3:GetObject) is not yet collected.

Footguns

Known gotchas

Avoid athena:* — grants full control including creating, updating, and deleting workgroups and data catalogs.

Avoid athena:RunQuery without resource restrictions — can run arbitrary queries that may incur high costs.

Resources

docshttps://servicereference.us-east-1.amazonaws.com/v1/athena/athena.json ↗