Managed AWS Athena Setup

Athena setup is Vendo-led. Use this checklist to prepare AWS; Vendo confirms the final connection fields and credential exchange for your workspace.

Before you start

• Create or select an Athena workgroup with appropriate scan controls.
• Confirm the Glue database and tables are queryable in Athena Console.
• Create a dedicated S3 prefix for query results.
• Identify the exact source bucket prefixes the queries need.

Required permission areas

The IAM principal generally needs permission to:

• Start, inspect, retrieve, and cancel queries in the selected Athena workgroup.
• Read the required Glue databases, tables, and partitions.
• Read only the approved source S3 prefixes.
• List the required buckets.
• Write and read the dedicated Athena result prefix.

Vendo will provide the final resource-scoped policy for the agreed configuration. Avoid broad Resource: "*" grants when the AWS service supports resource scoping.

Connect with Vendo

1. Share the non-secret region, workgroup, catalog, database, and S3 paths.
2. Agree on the credential method and rotation owner.
3. Apply the reviewed IAM policy.
4. Transfer credentials through the approved secret channel.
5. Ask Vendo to run metadata discovery and one bounded query.

Verify

1. Compare the visible database/table list with the approved scope.
2. Run the same small query in Athena Console and Vendo.
3. Compare row count, values, query region, and result location.
4. Review CloudTrail and Athena history for the Vendo principal.
5. Set an access-review and credential-rotation date.

Troubleshooting

Related

• AWS Athena overview
• Custom Integrations