AthenaQueryPolicy not useful without Glue permissions

[aidansteele]

The AthenaQueryPolicy SAM policy template doesn't work by itself. It requires some glue permissions - the full extent depending on what the principal needs to do.

I haven't been able to find any definitive docs on the minimal viable policy - this guide is the closest I could find. In my experience (and Googling for error messages) shows that most people need glue:GetTable and glue:GetPartitions.

Maybe you'd want to add more - I'm not sure if this policy should have glue:Create*, glue:Delete*, etc. If anything, that could be a different policy template.

Do you want me to submit a PR for this?

[hawflau]

Hi @aidansteele, thanks for your suggestion. It seems at the very least you'll need glue:GetTable, glue:getPartitions and glue:Partition. You'll also need to add the policy to allow reading the S3 location of the table, and writing query results to a S3 bucket.

We welcome community contributions! Please feel free to submit a PR. Ping me when it's ready for review :)