Amazon Athena (beta)

Amazon Athena connects through an AWS IAM role and temporary credentials. You provide the role ARN; you do not upload AWS access keys. This beta supports commercial AWS regions and Athena SQL workgroups. Workgroups requiring IAM Identity Center user identity propagation are not supported.

1. Configure AWS access

Open Connections → Add connection → Amazon Athena. Choose AWS region from the dropdown. Use the displayed AWS role trust policy and organization-specific External ID when configuring your role in AWS, then enter IAM role ARN.

The role needs access to the chosen Athena workgroup, catalog metadata, source data, and query results. Require the exact external ID shown by FastBI. Select Continue to verify role access and discover workgroups and catalogs. This step does not save a connection or run an Athena query.

If FastBI reports that Athena is not configured on the server, ask your FastBI administrator to enable the connector before continuing.

Choose a region and configure role access. A server configuration notice appears until your administrator enables Athena.

2. Confirm Athena settings

Choose the Workgroup and Catalog, or enter them manually. If the role cannot list resources, FastBI displays a notice; enter unavailable values manually. Listing permission is separate from query permission.

• Database (optional): restrict discovery to one database. Leave it blank to discover the databases available in the catalog.
• S3 results location (optional): enter an s3://bucket/prefix/ location, or leave it blank to use the workgroup configuration. Enforced workgroup settings take precedence.

Select Continue after confirming the settings.

3. Name and save

Enter Connection name and Connection slug. The slug identifies the connection in the SQL workbench: start with a lowercase letter and use lowercase letters, numbers, or underscores, up to 63 characters. lake is reserved.

Select Save & test. FastBI verifies access, runs a small test query, checks database discovery, and saves the connection before queuing catalog synchronization. A failed test does not replace a working saved connection.

Reusing access and query costs

The same IAM role can support several FastBI connections when its permissions cover their regions, workgroups, catalogs, and data. Each connection keeps its own source settings and name.

AWS bills Athena scans and storage to your AWS account. Start with a narrow query and use workgroup scan limits; a SQL row limit alone does not limit scanned bytes. Removing a FastBI connection does not remove results in S3 or delete your IAM role.