I am trying to make use of the Superset/AWS Athena connection and am running into some permissions issues.
I’ve successfully opened up a connection using a SQLAlchemy URI:
awsathena+rest://:@athena.us-east-1.amazonaws.com:443/default?s3_staging_dir=s3%3A%2F%2Fmy-athena-bucket%2Fathena-output%2F
And engine parameters:
{"connect_args":{"role_arn":"arn:aws:iam:::role/AwsDataCatalogdefaultAthenaAccessRole"}}
This connection works when using SQLLab.
However, when I attempt to create a chart, I am met with the following access denied error:
superset.charts.commands.exceptions.ChartDataQueryFailedError: Error: An error occurred (AccessDeniedException) when calling the StartQueryExecution operation: You are not authorized to perform: athena:StartQueryExecution on the resource. After your AWS administrator or you have updated your permissions, please try again.
I am aware that if you do not include user credentials within the Athena connection string, then superset falls back on the permission of its ECS task role. In this case, the error is caused by the ECS task not having the right access permissions.
But I assumed that the chart request would be made using the role arn that's defined in connect_args. Clearly, that's not happening. Any idea why this might be?
I am trying to make use of the Superset/AWS Athena connection and am running into some permissions issues.
I’ve successfully opened up a connection using a SQLAlchemy URI:
And engine parameters:
This connection works when using SQLLab.
However, when I attempt to create a chart, I am met with the following access denied error:
I am aware that if you do not include user credentials within the Athena connection string, then superset falls back on the permission of its ECS task role. In this case, the error is caused by the ECS task not having the right access permissions.
But I assumed that the chart request would be made using the role arn that's defined in
connect_args. Clearly, that's not happening. Any idea why this might be?