title: Athena permission denied while executing a query
body: <p>I have an AWS Lambda function that runs an Athena query to read some data.</p>
  <p>Here is the policy:</p>
  <pre class="lang-json prettyprint-override"><code>    {
          &quot;Version&quot;: &quot;2012-10-17&quot;,
          &quot;Statement&quot;: [
              {
                  &quot;Sid&quot;: &quot;Sid0&quot;,
                  &quot;Effect&quot;: &quot;Allow&quot;,
                  &quot;Action&quot;: [
                      &quot;athena:GetQueryExecution&quot;,
                      &quot;athena:GetQueryResults&quot;,
                      &quot;athena:GetWorkGroup&quot;,
                      &quot;athena:StartQueryExecution&quot;,
                      &quot;athena:StopQueryExecution&quot;
                  ],
                  &quot;Resource&quot;: &quot;*&quot;
              },
              {
                  &quot;Sid&quot;: &quot;Sid2&quot;,
                  &quot;Effect&quot;: &quot;Allow&quot;,
                  &quot;Action&quot;: [
                      &quot;glue:GetTable&quot;
                  ],
                  &quot;Resource&quot;: &quot;*&quot;
              },
              {
                  &quot;Sid&quot;: &quot;Sid4&quot;,
                  &quot;Effect&quot;: &quot;Allow&quot;,
                  &quot;Action&quot;: [
                      &quot;s3:AbortMultipartUpload&quot;,
                      &quot;s3:GetObject&quot;,
                      &quot;s3:ListMultipartUploadParts&quot;,
                      &quot;s3:PutObject&quot;
                  ],
                  &quot;Resource&quot;: [
                      &quot;arn:aws:s3:::BUCKET/db-access/*&quot;
                  ]
              },
              {
                  &quot;Sid&quot;: &quot;Sid5&quot;,
                  &quot;Effect&quot;: &quot;Allow&quot;,
                  &quot;Action&quot;: [
                      &quot;s3:ListBucketMultipartUploads&quot;,
                      &quot;s3:ListBucket&quot;,
                      &quot;s3:GetBucketLocation&quot;
                  ],
                  &quot;Resource&quot;: [
                      &quot;arn:aws:s3:::BUCKET&quot;
                  ]
              }
          ]
      }
  </code></pre>
  <p>When I run the query with admin user it works. When I run it with the Lambda role/policy it fails.</p>
  <pre class="lang-json prettyprint-override"><code>    &quot;StatementType&quot;: &quot;DML&quot;,
      &quot;ResultConfiguration&quot;: {
          &quot;OutputLocation&quot;: &quot;s3://BUCKET/db-access/athena-query-results/e26d9574-503c-45d8-9730-3d39e4293b3f.csv&quot;
      },
      &quot;QueryExecutionContext&quot;: {},
      &quot;Status&quot;: {
          &quot;State&quot;: &quot;FAILED&quot;,
          &quot;StateChangeReason&quot;: &quot;Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: 09DF293291383C76; S3 Extended Request ID: qx5MpYNSpoqWQHdQVT7rqExhkxaNI3oFlD4tXmPwwUtHNAw3wrd9cjrdeYb3mGA8X1Lnql+RSyA=; Proxy: null)&quot;,
          &quot;SubmissionDateTime&quot;: &quot;2020-10-20T12:17:34.855000+02:00&quot;,
          &quot;CompletionDateTime&quot;: &quot;2020-10-20T12:17:50.086000+02:00&quot;
      },
  </code></pre>
  <p>One really annoying aspect of this that we have cloudtrail enabled for the account but there is not such a requestid (09DF293291383C76 for example) when we query Cloudtrail. It seems that Athena is unable to write the result to the location even though with the same policy I am able to PutObject to that location. Not sure what else Athena is running before the PutObject but that is the action that is missing from the action list. Not sure how to debug this further.</p>
  <p>Update:</p>
  <p>After some investigation and help from AWS we tracked down the issue being a missing read permission from the Athena table's S3 location. Unfortunately we missed that location with CloudTrail too and Athena's error messages does not let you determine what is the actual problem.</p>