Athena query failed when trying to access S3 from access point

Question

Hi Community, 
Reaching out for an issue I ran into when I tried to S3 from Athena using S3 access point. I have an S3 gateway endpoint created in my VPC and it allows all access. Then I created an S3 access point within the bucket that saves the data. This access point does not have any policy attached to it. I have the S3 bucket policy below:
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "*",
            "Resource": [
                "arn:aws:s3:::BUCKET_NAME",
                "arn:aws:s3:::BUCKET_NAME/*"
            ],
            "Condition": {
                "StringEquals": {
                    "s3:DataAccessPointAccount": "ACCOUNT_ID"
                }
            }
        }
    ]
}
```

Then I created a table in Athena using the query below:
```
CREAT TABLE EXAMPLE_TABLE ...... ROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.lazy.LazySimpleSerDe' WITH SERDEPROPERTIES ('field.delim' = ',', "escapeChar" = "\'") STORED AS INPUTFORMAT 'org.apache.hadoop.mapred.TextInputFormat' OUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat' LOCATION 's3://S3_ACCESS_POINT_alias/data-inventory/' TBLPROPERTIES ('classification' = 'csv', "skip.header.line.count"="1")
```

This query turned out okay as it did not actually visit the data in S3. Then I used the query `select * from EXAMPLE_TABLE`, I got a error message in Athena suggesting that** access was denied**. It is really weird that this happened as I did not have any policy that's denying anything. Below is the screenshot. What could have gone wrong? You help is much appreciated.
![Enter image description here](/media/postImages/original/IM3yNnFI8OTHqbR6QY_E9gYw)

re:Post Agent · Answer

The access denied error you're encountering when trying to query your Athena table is likely due to insufficient permissions. There are a few potential issues to consider:

1. S3 Bucket Policy: Your current bucket policy only allows the ListBucket action on the access point. For Athena to read the data, you'll need to grant additional permissions such as s3:GetObject.

2. Access Point Policy: You mentioned that the access point doesn't have any policy attached. It's recommended to add a policy to the access point that explicitly allows the necessary actions for Athena.

3. IAM Permissions: Ensure that the IAM user or role you're using to execute the Athena query has the necessary permissions to both Athena and the S3 bucket/access point.

4. Region Consistency: Make sure that the S3 bucket, access point, and Athena are all in the same AWS region.

To resolve this issue:

1. Update your S3 bucket policy to include additional necessary permissions, such as s3:GetObject.

2. Add a policy to your S3 access point that allows the required actions for Athena.

3. Review and update the IAM permissions for the user or role executing the Athena query.

4. Double-check that all resources are in the same region.

5. Ensure that the S3 gateway endpoint in your VPC is correctly configured to allow access to S3.

If the issue persists after making these changes, you may need to review CloudTrail logs for more detailed error information or consult AWS Support for further assistance.  
**Sources**  
[Access Denied for ATHENA | AWS re:Post](https://repost.aws/questions/QUJ1oSEboDR7mB0kQkI0IOWg/access-denied-for-athena)  
[S3 Tables - Unable to query using Athena | AWS re:Post](https://repost.aws/questions/QUKVZfbxcJRXSjyhr_-Qs5PQ/s3-tables-unable-to-query-using-athena)  
[Unable to access the S3 bucket after the IAM user was recreated | AWS re:Post](https://repost.aws/articles/ARJ34iWcO0TUSrNjF7qpataA/unable-to-access-the-s3-bucket-after-the-iam-user-was-recreated)

Shahed Kazi (@shajam) · Answer

You already have a bucket policy. Both bucket policy and access point policy must allow the request. Here's an example.

Access Point Policy
```
{
    "Version":"2012-10-17",
    "Statement": [
    {
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::987654321012:role/AthenaRole"
        },
        "Action": ["s3:GetObject", "s3:PutObject"],
        "Resource": "arn:aws:s3:us-east-1:987654321012:accesspoint/my-access-point/object/Athena/*"
    }]
}
```

Bucket Policy

```
{
    "Version": "2012-10-17",
    "Statement": [
    {
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::987654321012:role/AthenaRole"
        },
        "Action": ["s3:GetObject", "s3:PutObject"],
        "Resource": "arn:aws:s3:::my-bucket/Athena/*"
    }]    
}
```

Refer: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points-policies.html

Athena query failed when trying to access S3 from access point

Add your answer

Relevant content