Athena "Unable to verify/create output bucket" Error When Invoked from Lambda (All Permissions Correct, Same Region)

Based on your description, there are a few potential causes for the "Unable to verify/create output bucket" error in Athena when invoked from Lambda, even when permissions appear to be correctly configured.

First, check the Lambda function logs in CloudWatch Logs for more detailed error information. This error often occurs when there's a networking issue preventing Lambda from accessing S3, which might not be immediately apparent from the error message alone.

Since you mentioned your Lambda is not in a VPC, network connectivity shouldn't be the issue. However, there are other potential causes to investigate:

1. Verify that the trailing slash in your OutputLocation is consistent. Your code shows "s3://workwall-athena-results-20250813/athena-results/" - make sure this exact path (with trailing slash) matches what's configured in the Athena workgroup.

2. Check if there are any Service Control Policies (SCPs) or other organization-level policies that might be restricting access, even though you mentioned being the root user.

3. Ensure that the IAM role attached to your Lambda function has the specific Athena permissions needed, not just S3 permissions. The role should have permissions like "athena:StartQueryExecution" and related Athena actions.

4. Try explicitly specifying the workgroup in your Athena query parameters:

const params = {
QueryString: "SELECT 1",
ResultConfiguration: {
OutputLocation: "s3://workwall-athena-results-20250813/athena-results/"
},
WorkGroup: "your-workgroup-name"
};

5. Verify that the bucket policy Resource paths exactly match the paths you're trying to access. The trailing slash in the bucket policy might be significant.

6. Try temporarily granting broader permissions to isolate whether it's a specific permission issue.

If none of these solutions work, you might be encountering an internal Athena error. In that case, you may need to contact AWS Support for further assistance, as they can investigate the specific details of your account configuration.
Sources
Error in Athena with Lambda function permission to check bucket ownership | AWS re:Post
ErrorCode: INTERNAL_ERROR_QUERY_ENGINE | AWS re:Post
Troubleshoot issues in Athena - Amazon Athena

In addition to s3:ListBucket, try granting the s3:GetBucketLocation permission to the Lambda execution role. Athena apparently uses this permission to discover the region hosting the bucket, rather than assuming it's in the same region where the Athena engine running the query is. https://repost.aws/knowledge-center/athena-output-bucket-error

Thank you for your response Leo, wha worked for me in the end after working back from open access: I updated my S3 bucket policy to explicitly allow:

• My Lambda execution role full access
• The Athena service principal (athena.amazonaws.com) with a condition restricting access to my specific Athena workgroup using aws:SourceArn
• The required ACL for Athena (s3:x-amz-acl) Example policy: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "<lambda-role-arn>" }, "Action": [ "s3:PutObject", "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::<bucket-name>", "arn:aws:s3:::<bucket-name>/" ] }, { "Effect": "Allow", "Principal": { "Service": "athena.amazonaws.com" }, "Action": "s3:PutObject", "Resource": [ "arn:aws:s3:::<bucket-name>", "arn:aws:s3:::<bucket-name>/" ], "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" }, "ArnLike": { "aws:SourceArn": "arn:aws:athena:<region>:<account-id>:workgroup/<workgroup-name>" } } }, { "Effect": "Allow", "Principal": { "Service": "athena.amazonaws.com" }, "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::<bucket-name>", "arn:aws:s3:::<bucket-name>/*" ], "Condition": { "ArnLike": { "aws:SourceArn": "arn:aws:athena:<region>:<account-id>:workgroup/<workgroup-name>" } } } ] }

Restricting Athena’s access to the specific workgroup and allowing the required ACL resolved the issue. Thanks again

I stand corrected, I think there was just a delay in the policy updating from the public access I had originally given it. I discovered that even with the recommended secure bucket policy (allowing my Lambda role and the Athena service principal with workgroup and ACL restrictions), Athena still fails with Unable to verify/create output bucket when invoked from Lambda. The only configuration that works is granting public access (Principal: "*" and turning off "Block all public access"), which is not suitable for production.

What I’ve confirmed:

• All resources (S3 bucket, Lambda, Athena workgroup) are in the same region (eu-west-1).
• Bucket owner enforced, no ACLs, no encryption, no VPC.
• Lambda role and Athena service principal are explicitly allowed in the bucket policy.
• Tried with and without aws:SourceArn and other conditions.
• Account-wide, root, and IAM user principals do not work.
• Athena queries succeed only with public access.

Policy failing: { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowLambdaRole", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::i" }, "Action": [ "s3:PutObject", "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::", "arn:aws:s3:::-results-20250813/" ] }, { "Sid": "AllowAthenaServicePutObjectWithACL", "Effect": "Allow", "Principal": { "Service": "athena.amazonaws.com" }, "Action": "s3:PutObject", "Resource": [ "arn:aws:s3:::**-20250813", "arn:aws:s3:::********-20250813/" ], "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } } }, { "Sid": "AllowAthenaServiceGetList", "Effect": "Allow", "Principal": { "Service": "athena.amazonaws.com" }, "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::ws-20250813", "arn:aws:s3:::w************-20250813/*" ] } ] }

I can only get access to the bucket when I make the bucket public (Principal: "*") Conclusion: It appears Athena requires public permissions for output bucket verification/creation in this scenario, which is a significant security concern. If anyone has found a way to make this work securely (without public access), please share. Otherwise, this may be an AWS limitation or bug. Any suggestions?