Athena - SQL

This document describes the steps required to configure Athena SQL to authenticate with Tabular and execute queries against Tabular managed Iceberg tables.

Athena SQL natively supports using an Iceberg REST catalog as a data source for queries. This includes the ability to read from and write to Tabular managed Iceberg tables stored in S3.

On this page:

Requirements

  1. Athena workgroup using the v3 engine or greater.
  2. AWS IAM identity provider configured in Tabular for authenticating AWS users.
  3. AWS IAM role (from step 2) granted the ability to invoke the Tabular catalog lambda (see IAM policy examples for API execution permissions)

Current Limitations

  • Athena does not support DDL statements such as CREATE TABLE for Iceberg REST catalog data sources.

Configuration

Step 1: Create a Custom data source

From the Athena console menu, go to Administration -> Data sources and click Create data source.

Choose the Custom or shared connector option.

Step 2: Enter data source details

Data source name

Enter your Tabular warehouse name. ( This must match exactly)

Lambda function arn

arn:aws:lambda:<region>:237881912361:function:iceracer-athena-tabular:latest

Replace <region> with the region where you are issuing Athena queries. We recommend you use the same region used by the Tabular warehouse you are querying.

Step 3: Verify data source

Click Next and then Create data source.

If this is successful, the databases from your Tabular warehouse will display in the Associated databases list on the data source details page.

Troubleshooting

The most common errors are related to the AWS IAM identity provider configuration.

If you see any errors regarding failure to invoke lambda verify that the corresponding IAM role arn in the error message has been granted execute-api:Invoke IAM policy (see IAM policy examples for API execution permissions).

If you see any errors regarding fetching databases, verify that the corresponding IAM role arn in the error message is configured as an IAM Identity Provider in the Tabular app. To do this, go to Connections -> Security -> AWS IAM identity provider in the Tabular app.

Note You must be granted the Security Admin role to edit AWS IAM configuration.

Query your Iceberg tables with Athena

  1. Navigate to the AWS Athena console.
  2. In the Data source dropdown menu, select your Tabular warehouse.
  3. Use the Athena query editor to run queries against any of the Iceberg tables in your Tabular warehouse.