> For the complete documentation index, see [llms.txt](https://docs.collibra.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.collibra.com/data-quality-self-hosted/connections/supported-connections/supported-jdbc-data-sources/connecting-to-amazon-athena.md). # Connecting to Amazon Athena This section contains details for Amazon Athena connections. Select an option from the dropdown menu to display information for a particular driver class. {% tabs %} {% tab title="Native" %} ## General information
FieldDescription
Data sourceAmazon Athena
Supported versions

2.0.35.1000

Driver version 3.8.0 supports IRSA (IAM Roles for Service Account connection authorization)

Connection stringjdbc:awsathena://
Packaged? No
Certified? Yes
Supported features
Estimate job Yes
Analyze data Yes
Schedule Yes
Processing capabilities
Pushdown Yes
Spark agent Yes
Yarn agent Yes
Parallel JDBC No
Java Platform version compatibility
JDK 8 Yes
JDK 11 Yes
## Minimum user permissions In order to bring your Athena data into Data Quality & Observability (self-hosted), you need the following permissions. * Read access on your Glue catalog and S3 buckets. * Write access on your S3 output location. * ROLE\_ADMIN assigned to your user in Collibra DQ. ``` {     "Version": "YYYY-MM-DD",     "Statement": [         {             "Sid": "VisualEditor0",             "Effect": "Allow",             "Action": [                 "athena:StartQueryExecution",                 "s3:ListBucketMultipartUploads",                 "athena:GetQueryResultsStream",                 "glue:GetTables",                 "glue:GetPartitions",                 "athena:GetQueryResults",                 "glue:BatchGetPartition",                 "s3:ListBucket",                 "glue:GetDatabases",                 "athena:ListQueryExecutions",                 "s3:ListMultipartUploadParts",                 "glue:GetTable",                 "glue:GetDatabase",                 "athena:GetWorkGroup",                 "s3:PutObject",                 "s3:GetObject",                 "glue:GetPartition",                 "glue:GetCatalogImportStatus",                 "athena:StopQueryExecution",                 "athena:GetQueryExecution",                 "s3:GetBucketLocation",                 "athena:BatchGetQueryExecution",                 "athena:DeletePreparedStatement",                 "athena:CreatePreparedStatement"             ],             "Resource": [                 "arn:aws:athena:*::workgroup/primary",                 "arn:aws:s3:::/*",                 "arn:aws:s3:::",                 "arn:aws:glue:*::catalog",                 "arn:aws:glue:*::database/",                 "arn:aws:glue:*::table//*"             ]         }     ] } ``` ## Recommended and required connection properties | Required | Connection Property | Type | Value | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Yes | Name | Text | The unique name of your connection. Ensure that there are no spaces in your connection name. | | Yes | Connection URL | String |

The connection string path of your Athena connection.

Use the appropriate JDBC connection URLs in your business tool configuration according to your private DNS configuration for your endpoint.

Athena's streaming API uses port 444 to stream the query results. When you use a JDBC/ODBC driver, Athena uses this port to stream the query results to the JDBC/ODBC driver installed on the client host. Therefore, unblock this port when you use a JDBC/ODBC driver to connect to Athena. If this port is blocked, your business intelligence tool might time out or fail to show query results when you run a query.Ensure that port 444 isn't blocked. If you use an AWS PrivateLink endpoint to connect to Athena, ensure that the security group attached to the AWS PrivateLink endpoint is open to inbound traffic on port 444. Athena uses port 444 to stream query results. If port 444 is blocked, then the results aren't streamed back to your client host. In such situations, you might receive an error message similar to "\[Simba]AthenaJDBC An error has occurred. Exception during column initialization". This can also cause the business intelligence tool to stop responding and not display the query results.Also ensure that the security group attached to your VPC endpoint allows traffic from the host where you installed the JDBC/ODBC driver.

When referring to the example below, replace the ${value} sections of the connection URL with your actual value.

:glasses-round: Example: jdbc:awsathena://AwsRegion=${region};S3OutputLocation=s3://${output\_location};MetadataRetrievalMethod=Query

| | Yes | Driver Name | String |

The driver class name of your Athena connection.

com.simba.athena.jdbc.Driver

| | Yes | Port | Integer |

The port number to establish a connection to the datasource.

The default port is 0

| | No | Limit Schemas | Option |

Allows you to manage usage and restrict visibility to only the necessary schemas in the Explorer tree.

See Limiting schemas to learn how to limit schemas from the Connection Management page.

When you include a restricted schema in the query of a DQ Job, the query scope may be overwritten when the job runs. While only the schemas you selected when you set up the connection are shown in the Explorer menu, users are not restricted from running SQL queries on any schema from the data source.

| | No | Source Name | String | N/A | | No | Target Agent | Option | The [Agent](/data-quality-self-hosted/installation/agent.md) that submits your Spark job for processing. | | Yes | Auth Type | Option |

The method to authenticate your connection.

The configuration requirements are different depending on the Auth Type you select. See Authentication for more details on available authentication types.

| | No | Properties | String | The configurable driver properties for your connection. Multiple properties must be semicolon-delimited, and each property=value pair, including the last one, must end with a semicolon (;). `abc=123;test=true;` | Your host can connect to Athena with either an Athena public service endpoint or an Athena private endpoint. For more information on setting the endpoint, see [Command line options](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-options.html) and [Boto3 documentation](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/core/session.html). {% endtab %} {% tab title="CDATA" %} ## General information
FieldDescription
Data sourceAmazon Athena
Supported versions21.0.8214.0
Connection stringjdbc:cdata:amazonathena
Packaged? Yes
Certified? Yes
Supported features
Estimate job Yes
Analyze data Yes
Schedule Yes
Processing capabilities
Pushdown Yes
Spark agent Yes
Yarn agent No
Parallel JDBC No
Java Platform version compatibility
JDK 8 Yes
JDK 11 Yes
## Minimum user permissions In order to bring your Athena data into Data Quality & Observability (self-hosted), you need the following permissions. * Read access on your Glue catalog and S3 buckets. * Write access on your S3 output location. * ROLE\_ADMIN assigned to your user in Collibra DQ. ``` {     "Version": "YYYY-MM-DD",     "Statement": [         {             "Sid": "VisualEditor0",             "Effect": "Allow",             "Action": [                 "athena:StartQueryExecution",                 "s3:ListBucketMultipartUploads",                 "athena:GetQueryResultsStream",                 "glue:GetTables",                 "glue:GetPartitions",                 "athena:GetQueryResults",                 "glue:BatchGetPartition",                 "s3:ListBucket",                 "glue:GetDatabases",                 "athena:ListQueryExecutions",                 "s3:ListMultipartUploadParts",                 "glue:GetTable",                 "glue:GetDatabase",                 "athena:GetWorkGroup",                 "s3:PutObject",                 "s3:GetObject",                 "glue:GetPartition",                 "glue:GetCatalogImportStatus",                 "athena:StopQueryExecution",                 "athena:GetQueryExecution",                 "s3:GetBucketLocation",                 "athena:BatchGetQueryExecution",                 "athena:DeletePreparedStatement",                 "athena:CreatePreparedStatement"             ],             "Resource": [                 "arn:aws:athena:*::workgroup/primary",                 "arn:aws:s3:::/*",                 "arn:aws:s3:::",                 "arn:aws:glue:*::catalog",                 "arn:aws:glue:*::database/",                 "arn:aws:glue:*::table//*"             ]         }     ] } ``` ## Recommended and required connection properties | Required | Connection Property | Type | Value | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Yes | Name | Text | The unique name of your connection. Ensure that there are no spaces in your connection name. | | Yes | Connection URL | String |

The connection string path of your Athena connection.

Use the appropriate JDBC connection URLs in your business tool configuration according to your private DNS configuration for your endpoint.

Athena's streaming API uses port 444 to stream the query results. When you use a JDBC/ODBC driver, Athena uses this port to stream the query results to the JDBC/ODBC driver installed on the client host. Therefore, unblock this port when you use a JDBC/ODBC driver to connect to Athena. If this port is blocked, your business intelligence tool might time out or fail to show query results when you run a query.Ensure that port 444 isn't blocked. If you use an AWS PrivateLink endpoint to connect to Athena, ensure that the security group attached to the AWS PrivateLink endpoint is open to inbound traffic on port 444. Athena uses port 444 to stream query results. If port 444 is blocked, then the results aren't streamed back to your client host. In such situations, you might receive an error message similar to "\[Simba]AthenaJDBC An error has occurred. Exception during column initialization". This can also cause the business intelligence tool to stop responding and not display the query results.Also ensure that the security group attached to your VPC endpoint allows traffic from the host where you installed the JDBC/ODBC driver.

When referring to the example below, replace the ${value} sections of the connection URL with your actual value.

:glasses-round: Example: jdbc:cdata:amazonathena:AwsRegion=northernvirginia;S3StagingDirectory=s3://\;database=default;

database=default; must be included in the connection URL, as shown in the example above.

| | Yes | Driver Name | String |

The driver class name of your Athena connection.

cdata.jdbc.amazonathena.AmazonAthenaDriver

| | Yes | Port | Integer |

The port number to establish a connection to the datasource.

The default port is 0

| | No | Limit Schemas | Option |

Allows you to manage usage and restrict visibility to only the necessary schemas in the Explorer tree.

See Limiting schemas to learn how to limit schemas from the Connection Management page.

When you include a restricted schema in the query of a DQ Job, the query scope may be overwritten when the job runs. While only the schemas you selected when you set up the connection are shown in the Explorer menu, users are not restricted from running SQL queries on any schema from the data source.

| | No | Source Name | String | N/A | | No | Target Agent | Option | The [Agent](/data-quality-self-hosted/installation/agent.md) that submits your Spark job for processing. | | Yes | Auth Type | Option |

The method to authenticate your connection.

The configuration requirements are different depending on the Auth Type you select. See Authentication for more details on available authentication types.

| | No | Properties | String | The configurable driver properties for your connection. Multiple properties must be semicolon-delimited, and each property=value pair, including the last one, must end with a semicolon (;). `abc=123;test=true;` | Your host can connect to Athena with either an Athena public service endpoint or an Athena private endpoint. For more information on setting the endpoint, see [Command line options](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-options.html) and [Boto3 documentation](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/core/session.html). {% endtab %} {% endtabs %} ## Authentication Select an authentication type from the dropdown menu. The options available in the dropdown menu are the currently supported authentication types for this data source. {% tabs %} {% tab title="Username/Password" %} | Required | Field | Description | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------------------------------ | | Yes | Username | The username of your Athena account. | | Yes | Password | The password of your Athena account. | | {% endtab %} | | | {% tab title="Instance Profile" %} ### Setting up a single role-based Athena connection using AWS EC2 roles for Instance Profile authentication {% hint style="warning" %} This authentication option is only available for Athena CDATA driver versions 24.0.8994 and newer. {% endhint %} 1. Set the Connection URL to reference the required parameters. ``` jdbc:cdata:amazonathena:AuthScheme=AwsEC2Roles;MetadataDiscoveryMethod=Athena;AWSRoleARN=arn:aws:iam::${AccountID}:role/${RoleName};Database=${ConnectionName};DataSource=${DBName};AWSRegion=${Region};S3StagingDirectory=${S3DirectoryPath};Workgroup=${WorkgroupName} ```

You can optionally include the log parameters by adding Logfile=/tmp/example-log.log;Verbosity=5; to the Connection URL to see any errors that occur with the CDATA driver.

2. Click **Submit**. ### Setting up multiple role-based Athena connections using AWS EC2 roles for Instance Profile authentication {% hint style="warning" %} This authentication option is only available for Athena CDATA driver versions 24.0.8994 and newer. {% endhint %} {% stepper %} {% step %} Create a cache location folder in the **/tmp** directory where Collibra DQ is running for each role-based Athena connection you wish to use to allow CDATA to add the Instance Profile credential file to them. Multiple role-based Athena connections cannot share the same folder in the /tmp directory. :glasses-round: Example: If you have 2 different role-based Athena connections, the folder for the first connection could be called **/tmp/connA/** and the second could be called **/tmp/connB/**. *** {% endstep %} {% step %} Set the Connection URL to reference the required parameters. ``` jdbc:cdata:amazonathena:AuthScheme=AwsEC2Roles;MetadataDiscoveryMethod=Athena;AWSRoleARN=arn:aws:iam::${AccountID}:role/${RoleName};Database=${ConnectionName};DataSource=${DBName};AWSRegion=${Region};S3StagingDirectory=${S3DirectoryPath};Workgroup=${WorkgroupName};Location=${/tmp/connection/};CredentialsLocation=${/tmp/connection/CredentialsFile.txt} ``` {% hint style="success" %} You can optionally include the log parameters by adding `Logfile=/tmp/example-log.log;Verbosity=5;` to the Connection URL to see any errors that occur with the CDATA driver. {% endhint %} {% endstep %} {% step %} Click **Submit**. {% endstep %} {% endstepper %} {% endtab %} {% tab title="Password Manager" %} | Required | Field | Description | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Yes | Username | The username of your Athena account. | | Yes | Script |

The file path containing the script file that the password manager uses to interact with and authenticate a user account.

:glasses-round: Example: /tmp/keytab/athena\_pwd\_mgr.sh

| | No | Param $1 | Optional. An additional parameter to authenticate your Athena connection. | | No | Param $2 | Optional. An additional parameter to authenticate your Athena connection. | | No | Param $3 | Optional. An additional parameter to authenticate your Athena connection. | | {% endtab %} | | | | {% endtabs %} | | | ## Known limitation Data Quality & Observability (self-hosted) doesn't support Federated Catalogs in AWS Athena when using either the Simba JDBC driver or the CDATA JDBC driver.