Skip to main content
Resolve can query data using AWS Athena — useful for investigating CloudTrail audit logs, VPC Flow Logs, ALB access logs, and other operational data stored in S3.
AWS does not offer a read-only Athena managed policy. You need to create a custom inline policy on the IAM role used by Resolve.

​
1. Add Athena Permissions

On the same IAM role created in the AWS setup guide (resolve-access-role), add a custom inline policy with the following JSON:
About these permissions:
  • Athena actions allow Resolve to run read-only SQL queries and discover databases/tables. Resolve enforces that only SELECT, SHOW, DESCRIBE, and EXPLAIN queries are executed.
  • Glue read-only actions are required because Athena uses the AWS Glue Data Catalog to store table metadata.
  • S3 write access (PutObject) is scoped to the Athena query results bucket only — Athena must write query output to S3. If your results bucket uses a different naming pattern, adjust the Resource ARN accordingly.

​
2. Configure Your Athena Workgroup

Your Athena workgroup must have a default query results S3 location configured. Without this, queries will fail.
  1. In the AWS Console, go to Amazon Athena > Workgroups
  2. Select your workgroup (typically primary)
  3. Click Edit and set the Query result location (e.g., s3://aws-athena-query-results-ACCOUNT_ID-REGION/)
  4. Save

​
3. Safety Guardrails

Resolve enforces several safety measures for Athena queries:
  • IAM Role Permissions — The IAM roles configured above only provide read permissions for Athena query execution.
  • Read-only SQL only — Only SELECT, SHOW, DESCRIBE, and EXPLAIN queries are permitted. DDL/DML (CREATE, DROP, INSERT, etc.) is blocked.
  • 60-second timeout — Queries running longer than 60 seconds are automatically cancelled.
  • 100 GB data scan limit — Queries scanning more than 100 GB of data are automatically cancelled to prevent unexpected costs.
  • 1,000 row result limit — Query results are capped at 1,000 rows.