Access S3 access point based Athena source in QuickSight

To resolve the access issue between QuickSight and Athena when using S3 access points with Requester Pays enabled, you need to ensure that QuickSight has proper permissions to access the S3 buckets that Athena uses.

The error you're encountering is an S3 access denial, which suggests that while your Athena workgroup can access the data with Requester Pays enabled, QuickSight doesn't have the necessary permissions to access the same S3 buckets.

Here's how to address this:

1. In the QuickSight console, click on your profile name in the upper right corner
2. Select "Manage QuickSight" and then "Security & permissions"
3. Under "QuickSight access to AWS services," click "Add or remove"
4. Find Athena in the list, uncheck it and then check it again to refresh the connection
5. Choose "Connect both"
6. Select the S3 buckets that you need to access through Athena, including the access point alias bucket
7. Click "Select" to save your S3 bucket selections
8. Click "Update" to save your new settings

If you're using S3 access points, note that Amazon S3 generates an alias for each access point in S3 bucket name format. Athena can use this alias in the LOCATION clause of CREATE TABLE statements, and the access is controlled by the policy for that access point.

For S3 buckets with Requester Pays enabled, you may need to ensure that the QuickSight IAM role has permissions that explicitly allow it to make requests where the requester pays for data transfer costs. This might require additional IAM policy configurations beyond the standard QuickSight S3 bucket access settings.

If the standard approach doesn't work, you might need to contact AWS Support as there could be limitations with QuickSight's ability to handle Requester Pays buckets through access points.
Sources
Datasets using S3 files in another AWS account - Amazon QuickSight
Insufficient permissions when using Athena with Amazon QuickSight - Amazon QuickSight
Control access to Amazon S3 from Athena - Amazon Athena

As I wrote in the description of the issue, Athena works. QuickSight doesn't. The auto generated response is not helpful. Requesting someone with knowledge on this to reply. Thank you.

Hello.

What IAM policy is currently set for the IAM role "aws-quicksight-service-role-v0" used by QuickSight?
If the IAM role used by QuickSight does not have permission to access S3, an error will occur.
https://repost.aws/knowledge-center/quicksight-permission-errors

When QuickSight interacts with other AWS services, QuickSight assumes the aws-quicksight-service-role-v0 and aws-quicksight-s3-consumers-role-v0 service roles, and then attaches managed policies to the roles. Remove these service roles, and then remove the attached managed policies. Finally, restore QuickSight access to your AWS services.

The following documents may also be helpful:
https://repost.aws/knowledge-center/quicksight-access-denied-athena-data

You might also want to ask a question in the QuickSight Community.
https://community.amazonquicksight.com/c/question-and-answer

Thanks for your reply Riku. The source s3 bucket is located in another AWS account. The S3 bucket has been granted access through an access point. When I add the arn of the access point to the aws-quicksight-service-role-v0 IAM role for the necessary s3 actions such as GetObject and ListBucket, QuickSight is not able to access the data. If I add the arn of the s3 bucket itself (I had to change the bucket policy from the access point delegate permissions to direct permission for the account where QuickSight resides), it works.

Is it possible to use the s3 access point?

Any update Riku or anyone?