Choose how Atlan connects to Amazon Athena
Pick the right AWS identity type and network path for Atlan to connect to Amazon Athena - IAM access keys, IAM role delegation, or either with AWS PrivateLink.
Athena is different from most databases: there is no username and password. Atlan connects as an AWS identity that your AWS administrator grants access to. This page helps you pick the right identity type and network path in about two minutes.
Before you start: Two facts you need
Every path below depends on knowing these. Gather them first - they determine which options apply to you and who you'll need to involve.
| Fact | How to find it |
|---|---|
| Which AWS account and region your Athena and Glue Data Catalog live in | Ask your AWS administrator, or check the region shown in the top-right of the Athena console. Atlan connects to athena.<region>.amazonaws.com - you'll need the region for the host field, and the account for IAM setup. |
| Whether your security policy allows long-lived access keys, or requires IAM roles / private connectivity | Ask whoever owns AWS security in your organization. Many organizations forbid IAM user access keys - in that case, plan for the IAM role path and budget for a support-ticket handshake with Atlan. |
Compare connectivity methods
| IAM access keys (IAM user) | IAM role delegation (cross-account) | Either + AWS PrivateLink | |
|---|---|---|---|
| What Atlan presents | A long-lived access key + secret key for an IAM user you create | A temporary identity: Atlan's own AWS role "assumes" a role you create | Same identity as chosen; the network path changes |
| Traffic path | AWS public API endpoints, TLS-encrypted | AWS public API endpoints, TLS-encrypted | Stays on AWS's private network via a VPC interface endpoint |
| Secrets stored in Atlan | Yes - the key pair | No long-lived secret (role ARN + external ID only) | Unchanged |
| Who is involved | You + your AWS admin | You + your AWS admin + Atlan support (allowlist step) | All of the above + Atlan support |
| Typical setup time | Under an hour | 1–3 business days (includes the Atlan-side allowlist handshake) | Add 1–3 business days |
| Best for | Fast start, sandboxes, POCs | Production - most security teams' preference | Organizations that prohibit traffic over public endpoints |
| Start here | Access keys guide | IAM role guide | Atlan Network Details → support ticket |
IAM role delegation is two-sided. Creating the role in your AWS account is only half the setup - Atlan support must also allowlist your role on their side before the connection can work, and this must be repeated for every Atlan tenant (dev, prod) you connect. It's Phase 3 of the IAM role guide.
Which method to pick
- Pick IAM access keys if you're evaluating Atlan or your security policy permits long-lived keys. It's self-serve end to end - no support ticket needed.
- Pick IAM role delegation for production. No permanent secret is stored, access can be revoked instantly on your side, and most AWS security teams require it. Budget for the allowlist handshake.
- Add PrivateLink only if your organization prohibits connections to AWS's public API endpoints. It changes the network path, not the identity - you still pick keys or a role first.
A working Athena connection needs permissions on Athena (run queries), Glue (read the data catalog), S3 (fetch query results from your results bucket), and sometimes Lake Formation and KMS. A connection can pass the authentication test and still fail when crawling because one of the four is missing. See Permissions & the S3 results bucket.
See also
- How IAM role delegation works: The 5-minute explainer - no AWS knowledge assumed. Read this if "trust policy" or "external ID" are new terms.
- Atlan Network Details: What identity Atlan connects as, which values are tenant-specific, and exactly what to ask support for.
- Connect with an IAM role: Four phases, each labeled with who performs it - including the Atlan-side allowlist step.
- Troubleshooting Athena connectivity: Symptom-first index with the exact error text you'll see.