> ## Documentation Index
> Fetch the complete documentation index at: https://docs.resolve.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Athena

Resolve can query data using AWS Athena — useful for investigating CloudTrail audit logs, VPC Flow Logs, ALB access logs, and other operational data stored in S3.

<Info>
  AWS does not offer a read-only Athena managed policy. You need to create a custom inline policy on the IAM role used by Resolve.
</Info>

## 1. Add Athena Permissions

On the same IAM role created in the [AWS setup guide](/aws) (`resolve-access-role`), add a custom inline policy with the following JSON:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AthenaQueryAccess",
      "Effect": "Allow",
      "Action": [
        "athena:StartQueryExecution",
        "athena:GetQueryExecution",
        "athena:GetQueryResults",
        "athena:StopQueryExecution",
        "athena:ListDatabases",
        "athena:ListDataCatalogs",
        "athena:ListTableMetadata",
        "athena:ListWorkGroups",
        "athena:GetWorkGroup"
      ],
      "Resource": "*"
    },
    {
      "Sid": "GlueReadOnly",
      "Effect": "Allow",
      "Action": [
        "glue:GetDatabase",
        "glue:GetDatabases",
        "glue:GetTable",
        "glue:GetTables",
        "glue:GetPartitions"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AthenaQueryResultsAccess",
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:GetObject",
        "s3:ListBucket",
        "s3:PutObject",
        "s3:ListMultipartUploadParts",
        "s3:AbortMultipartUpload",
        "s3:ListBucketMultipartUploads"
      ],
      "Resource": [
        "arn:aws:s3:::aws-athena-query-results-*",
        "arn:aws:s3:::aws-athena-query-results-*/*"
      ]
    }
  ]
}
```

<Info>
  **About these permissions:**

  * **Athena** actions allow Resolve to run read-only SQL queries and discover databases/tables. Resolve enforces that only `SELECT`, `SHOW`, `DESCRIBE`, and `EXPLAIN` queries are executed.
  * **Glue** read-only actions are required because Athena uses the AWS Glue Data Catalog to store table metadata.
  * **S3** write access (`PutObject`) is scoped to the Athena query results bucket *only* — Athena must write query output to S3. If your results bucket uses a different naming pattern, adjust the `Resource` ARN accordingly.
</Info>

## 2. Configure Your Athena Workgroup

Your Athena workgroup must have a **default query results S3 location** configured. Without this, queries will fail.

1. In the AWS Console, go to **Amazon Athena > Workgroups**
2. Select your workgroup (typically `primary`)
3. Click **Edit** and set the **Query result location** (e.g., `s3://aws-athena-query-results-ACCOUNT_ID-REGION/`)
4. Save

## 3. Safety Guardrails

Resolve enforces several safety measures for Athena queries:

* **IAM Role Permissions** — The IAM roles configured above only provide read permissions for Athena query execution.
* **Read-only SQL only** — Only `SELECT`, `SHOW`, `DESCRIBE`, and `EXPLAIN` queries are permitted. DDL/DML (`CREATE`, `DROP`, `INSERT`, etc.) is blocked.
* **60-second timeout** — Queries running longer than 60 seconds are automatically cancelled.
* **100 GB data scan limit** — Queries scanning more than 100 GB of data are automatically cancelled to prevent unexpected costs.
* **1,000 row result limit** — Query results are capped at 1,000 rows.