Access policy for Athena access to S3

Question

Hello,

I'm trying to run from Athena a command to generate an Iceberg table like below (main purpose: register S3 table bucket catalogs in Athena)
```
CREATE TABLE default.temp_table (id bigint, data string, category string)
PARTITIONED BY (category, bucket(16, id))
LOCATION '--table-s3>'
TBLPROPERTIES ( 'table_type' = 'ICEBERG' )
```
but I got an S3 access error: `Access to the specified S3 resource is denied, please check your IAM/S3 bucket policies and any relevant KMS permissions`  
I've tried the below policy on the S3 bucket, but I have same error:
```
{
            "Effect": "Allow",
            "Principal": {
                "Service": "athena.amazonaws.com"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::pics-repository/*"
        }
```
Could you please specify how should look the S3 permission for such access ?

Thank you,

re:Post Agent · Answer

1. IAM Role Policy:
First, ensure that the IAM role used by Athena has the necessary permissions to access S3. You should attach a policy to the IAM role that includes the following permissions:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::pics-repository",
                "arn:aws:s3:::pics-repository/*"
            ]
        }
    ]
}
```

This policy grants the necessary S3 permissions for Athena to read from and write to your S3 bucket.

2. S3 Bucket Policy:
The S3 bucket policy you provided is close, but it needs some adjustments. Here's an improved version:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "athena.amazonaws.com"
            },
            "Action": [
                "s3:GetBucketLocation",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::pics-repository",
                "arn:aws:s3:::pics-repository/*"
            ]
        }
    ]
}
```

This policy explicitly allows Athena to perform the necessary actions on your S3 bucket.

3. Additional Considerations:
- Ensure that the IAM role Athena is using has the necessary permissions to create and manage Iceberg tables.
- If you're using AWS Glue Data Catalog, make sure the IAM role has permissions to access and modify Glue databases and tables.
- If your S3 bucket uses AWS KMS for encryption, you'll need to grant the IAM role permissions to use the KMS key.

By implementing these permissions, you should be able to resolve the S3 access error and successfully create your Iceberg table using Athena. Remember to replace "pics-repository" with your actual S3 bucket name in both policies.

**Sources**  
[Control access to Amazon S3 from Athena - Amazon Athena](https://docs.aws.amazon.com/athena/latest/ug/s3-permissions.html)  
[Allow access to Athena UDFs: Example policies - Amazon Athena](https://docs.aws.amazon.com/athena/latest/ug/udf-iam-access.html)  
[AWS managed policies for Amazon Athena - Amazon Athena](https://docs.aws.amazon.com/athena/latest/ug/managed-policies.html)

Access policy for Athena access to S3

Add your answer

Relevant content