Connection Issue Between Tableau (Desktop/Cloud) and Amazon Athena

Question

Hi everyone,

I'm experiencing a connection issue between Tableau (both Desktop and Cloud) and Amazon Athena. The error message I'm receiving is:

Unexpected Error

[Simba][AthenaJDBC](100071) An error has been thrown from the AWS Athena client. Access denied when writing output to url: s3://XXXXXXXX/YYYYYYY . Please ensure you are allowed to access the S3 bucket. If specifying an expected bucket owner, confirm the bucket is owned by the expected account. If you are encrypting query results with KMS key, please ensure you are allowed to access your KMS key [Execution ID: RRRRRRRRRRR]

Error Code: 399C2292

I can see the files and their headers, but I'm unable to access the data within these files. I'm wondering what could be causing this problem and what specific permissions I need to have to access the data.

Has anyone encountered a similar issue or have any insights on how to resolve this? Any help would be greatly appreciated!

Thank you!

Matz Rasmus · Accepted Answer

Hi @Vincent Laplanche​ , You will need to make sure that you have write access to the S3 bucket you specified as your S3 Staging Directory  Whenever you are running a query, the results will be written to this bucket/prefix, and these results read by Tableau

Tableau Community Forums Member (Inactive) · Answer

Detailed Resolution Steps:   Verify S3 Bucket Permissions:   ·      IAM User/Role Permissions: Ensure that the IAM user or role used by Tableau has the necessary permissions to access the S3 bucket. This includes: ·      s3:ListBucket ·       - Allows listing of the bucket. ·      s3:GetObject ·       - Allows reading objects from the bucket. ·      s3:PutObject ·       - Allows writing objects to the bucket. ·      Bucket Policy: Verify the bucket policy to ensure it allows access from the IAM user or role. Here is an example of a bucket policy that grants access to a specific IAM role:   Check KMS Key Permissions: ·      IAM User/Role Permissions: If you are using a KMS key to encrypt query results, ensure that the IAM user or role has the necessary permissions to use the KMS key. This includes: ·      kms:Encrypt ·      kms:Decrypt ·      kms:GenerateDataKey ·      kms:DescribeKey KMS Key Policy: Check the KMS key policy to ensure it grants access to the IAM user or role. Here is an example of a KMS key policy: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::ACCOUNT-ID:role/ROLE-NAME" }, "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey", "kms:DescribeKey" ], "Resource": "*" } ] }   Configure Cross-Account Access: If the S3 bucket or KMS key is in a different AWS account, ensure that cross-account access is properly configured. This involves setting the appropriate bucket policy and KMS key policy to allow access from the other account Verify Athena Workgroup Settings: Ensure that the Athena workgroup settings are correctly configured to use the specified S3 bucket and KMS key. Verify that the workgroup has the necessary permissions to access these resources   Check Network and Endpoint Configuration: Ensure that the network configuration allows access to the S3 bucket and KMS key. This includes verifying VPC endpoints and security group settings if applicable Make sure that ports 443 and 444 are open. Athena uses port 443 to connect to the host, and Athena's streaming API uses port 444 to stream query results Driver and Connection Settings: Ensure that you are using the correct version of the Athena JDBC driver. Download the latest version of the Athena JDBC driver JAR with bundled AWS SDK Place the driver in the correct Tableau driver location: For Windows:  C:\Program  Files\Tableau\Drivers For macOS: ~/Library/Tableau/Drivers Restart Tableau and then connect to Athena

Connection Issue Between Tableau (Desktop/Cloud) and Amazon Athena

Tableau Desktop & Web Authoring

Related Learning

More Help