quicksight integration with S3Tables via Athena

Question

Hello, we need to connect QuickSight to lake formation catalog in order to access Iceberg tables stored in S3Tables service. Data is in s3tables buckets, managed via Lake Formation. Our Glue does not have S3Tables catalogs mapped. 
We can access the data with Athena regularly without any problem, both via GUI and via python using athena hook. the QuickSight account is set and *aws-quicksight-service-role-v0* has all read and list permissions set for Athena,Glue and Lake formation. in lake formation also set the permissions to *describe,read, select* for all datasets/namespaces/tables.
We still not able to access the data. Are there any constraints that limits the data access to iceberg tables in s3tables service from QuickSight via Athena connector? example query:* select * from "s3tablescatalog/some_catalog"."some_namespace"."some_table"* --> works with Athena GUI and from python via Athena Hook
Who can help me doing this connection? 
Thank you.

re:Post Agent · Answer

To connect QuickSight to S3 Tables via Athena, there are several specific permissions and configurations you need to set up beyond the standard service role permissions.

Based on your description, while you've set up the aws-quicksight-service-role-v0 with permissions for Athena, Glue, and Lake Formation, there are additional QuickSight-specific permissions required:

1. You need to identify the QuickSight admin user's ARN and grant Lake Formation permissions specifically to this user/ARN. You can find this by running:
```
aws quicksight list-users --aws-account-id  --namespace default --region 
```

2. In Lake Formation, you need to grant permissions to this QuickSight admin user ARN:
- Navigate to Lake Formation console > Data permissions > Grant
- Under Principals, select "SAML users and groups" and add the QuickSight admin user's ARN
- Select "Named Data Catalog Resources" and grant permissions at both:
- Database level: Select the S3 Tables catalog and database
- Table level: Select the S3 Tables catalog, database, and table

3. In QuickSight, ensure you've authorized access to both Athena and the specific S3 buckets:
- In QuickSight console, go to your profile > Manage QuickSight > Security & Permissions
- Under "QuickSight access to AWS services", select Manage
- Enable Athena and specify the S3 bucket that contains your data

Common issues that might be causing your problem:
- The QuickSight service role permissions are different from the QuickSight user permissions in Lake Formation
- Table or column names might contain capital letters, which can cause errors with S3 Tables
- The QuickSight admin user specifically needs Lake Formation permissions, not just the service role

If you're still encountering issues after these steps, check for error messages in QuickSight when attempting to connect, as they can provide more specific guidance on what permissions might be missing.  
**Sources**  
[Analyzing Amazon S3 Metadata with Amazon Athena and Amazon QuickSight | AWS Storage Blog](https://aws.amazon.com/blogs/storage/analyzing-amazon-s3-metadata-with-amazon-athena-and-amazon-quicksight/)  
[How to consume tabular data from Amazon S3 Tables for insights and business reporting | AWS Storage Blog](https://aws.amazon.com/blogs/storage/how-to-consume-tabular-data-from-amazon-s3-tables-for-insights-and-business-reporting/)  
[Use the solution - Amazon Marketing Cloud Insights on AWS](https://docs.aws.amazon.com/solutions/latest/amazon-marketing-cloud-insights-on-aws/using-the-solution.html)  
[Querying Amazon S3 tables with Athena - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-athena.html)  
[Visualizing table data with Quick Suite - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-quicksight.html)

quicksight integration with S3Tables via Athena

Add your answer

Relevant content