- Newest
- Most votes
- Most comments
There was either an s3tables permissions or catalog permission. either "s3tables:ListTables" or "glue:GetTables"
answered a year ago
Based on your error message, it appears you're encountering a "Table not found" error when trying to query an S3 table using Athena. Since the query works locally with your credentials but fails when using the ECS execution role, this is indeed likely a permissions issue.
While you've added the s3tables:* permissions to your ECS execution role, you may be missing some required Lake Formation permissions. Even though you mentioned setting "Super" permissions on the database in Lake Formation, there are a few additional things to check:
-
Make sure your ECS execution role has the necessary AWS Glue permissions to access the table metadata. You likely need to add permissions like
glue:Get*to your role. -
Verify that you've properly registered the S3 table bucket catalog as a data source in Athena.
-
Ensure that you've granted specific Lake Formation permissions on the S3 table to your ECS execution role. The "Super" database permissions might not be sufficient - you may need to explicitly grant permissions on the table itself.
-
Check that you're using the correct catalog in your query. S3 Tables use a separate catalog from the default AWS Glue Data Catalog, which appears to be what you're doing with "s3tablescatalog/eos-ads-analytics-all-prod".
-
If you're using an opt-in region, make sure it's enabled for your account.
The most common resolution for this type of error is ensuring that the role has both the appropriate S3 permissions and the required Glue/Lake Formation permissions to access the table metadata.
Sources
Athena Query Error using Python | AWS re:Post
S3 Tables - Unable to query using Athena | AWS re:Post
Querying Amazon S3 tables with Athena - Amazon Simple Storage Service
answered a year ago
what has glue got to do with the s3 table buckets?
Relevant content
asked a year ago

We managed to get around this issue by adding some additional permissions but now we face this error:
[ERROR] [AthenaConnector::query] Error: Table offers_dataset not found in database ro_reporting The error goes away after adding the following policy:
{ "Version": "2012-10-17", "Statement": [ { "Sid": "BaseGluePermissions", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetCatalog", "glue:GetCatalogs", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "glue:StartColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRun", "glue:GetColumnStatisticsTaskRuns", "glue:GetCatalogImportStatus" ], "Resource": [ "*" ]Do you know which resource(s) should i put for glue and data-lake permissions respectively? i wouldn't want to leave all.