title: boto3 and AWS Athena permission
body: <p>I am trying to use <code>boto3</code>, v. 1.7.4, to interact with AWS Athena through the following script:</p>
  
  <pre><code>import boto3
  import botocore
  
  # Test access to the input bucket
  bucket = boto3.resource('s3').Bucket('s3_input')
  print(list(bucket.objects.all())
  
  client = boto3.client('athena', region_name='us-east-1')
  
  # Create a new database
  db_query = 'CREATE DATABASE IF NOT EXISTS france;'
  response = client.start_query_execution(
      QueryString=db_query,
      ResultConfiguration={'OutputLocation': 's3_output'})
  
  # Create a new table
  table_query = '''
  CREATE EXTERNAL TABLE IF NOT EXISTS france.by_script (`content` string ) 
  ROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.OpenCSVSerde'
  WITH SERDEPROPERTIES ('separatorChar' = ',')
  LOCATION 's3_input';'''
  
  response = client.start_query_execution(
      QueryString=table_query,
      ResultConfiguration={'s3_output'},
      QueryExecutionContext={'Database': 'france'})
  </code></pre>
  
  <p>With the current permissions of my account, the test to read the content of <code>s3_input</code> works well. I can also create the database through the <code>db_query</code> but the table creation fails with the following error message:</p>
  
  <pre><code>Your query has the following errors:FAILED: Execution Error, return
  code 1 from org.apache.hadoop.hive.ql.exec.DDLTask.
  MetaException(message:Got exception: java.io.IOException
  com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.model.AmazonS
  Exception: Access Denied (Service: Amazon S3; Status Code: 403; Error Code:
  AccessDenied; Request ID: [...]), S3 Extended Request ID: [...])
  </code></pre>
  
  <p>If I run the <code>table_query</code> command from the console, <a href="https://console.aws.amazon.com/athena/home" rel="nofollow noreferrer">console.aws.amazon.com/athena/home</a>, using the same account, there is no problem and the table is properly created.</p>
  
  <p>The permissions are</p>
  
  <pre><code>{
     "Version": "2012-10-17",
     "Statement": [
         {
             "Sid": "VisualEditor0",
             "Effect": "Allow",
             "Action": "s3:GetObject",
             "Resource": "s3_input"
         },
         {
             "Sid": "VisualEditor1",
             "Effect": "Allow",
             "Action": [
                 "s3:ListAllMyBuckets",
                 "s3:HeadBucket"
             ],
             "Resource": "*"
         }
     ]
  }
  </code></pre>
  
  <p>I would be happy to understand what I am missing here.
  Thanks in advance.</p>