## Choose how Atlan connects to Amazon Athena

URL: https://docs.atlan.com/apps/connectors/database/amazon-athena/how-tos/choose-how-atlan-connects-to-amazon-athena

> Pick the right AWS identity type and network path for Atlan to connect to Amazon Athena - IAM access keys, IAM role delegation, or either with AWS PrivateLink.

Athena is different from most databases: there is no username and password. Atlan connects as an **AWS identity** that your AWS administrator grants access to. This page helps you pick the right identity type and network path in about two minutes.

## Before you start: Two facts you need

Every path below depends on knowing these. Gather them first - they determine which options apply to you and who you'll need to involve.

| Fact | How to find it |
|---|---|
| **Which AWS account and region your Athena and Glue Data Catalog live in** | Ask your AWS administrator, or check the region shown in the top-right of the Athena console. Atlan connects to `athena.<region>.amazonaws.com` - you'll need the region for the host field, and the account for IAM setup. |
| **Whether your security policy allows long-lived access keys, or requires IAM roles / private connectivity** | Ask whoever owns AWS security in your organization. Many organizations forbid IAM user access keys - in that case, plan for the IAM role path and budget for a support-ticket handshake with Atlan. |

## Compare connectivity methods

| | IAM access keys (IAM user) | IAM role delegation (cross-account) | Either + AWS PrivateLink |
|---|---|---|---|
| **What Atlan presents** | A long-lived access key + secret key for an IAM user you create | A temporary identity: Atlan's own AWS role "assumes" a role you create | Same identity as chosen; the network path changes |
| **Traffic path** | AWS public API endpoints, TLS-encrypted | AWS public API endpoints, TLS-encrypted | Stays on AWS's private network via a VPC interface endpoint |
| **Secrets stored in Atlan** | Yes - the key pair | No long-lived secret (role ARN + external ID only) | Unchanged |
| **Who is involved** | You + your AWS admin | You + your AWS admin + **Atlan support (allowlist step)** | All of the above + Atlan support |
| **Typical setup time** | Under an hour | 1–3 business days (includes the Atlan-side allowlist handshake) | Add 1–3 business days |
| **Best for** | Fast start, sandboxes, POCs | Production - most security teams' preference | Organizations that prohibit traffic over public endpoints |
| **Start here** | [Access keys guide](https://docs.atlan.com/llms/connectors/amazon-athena/connect-with-iam-access-keys/llms.txt) | [IAM role guide](https://docs.atlan.com/llms/connectors/amazon-athena/connect-with-an-iam-role/llms.txt) | [Atlan Network Details](https://docs.atlan.com/llms/governance/administration/atlan-network-details/llms.txt) → support ticket |

:::caution The step most setups miss

IAM role delegation is **two-sided**. Creating the role in your AWS account is only half the setup - **Atlan support must also allowlist your role on their side** before the connection can work, and this must be repeated for *every* Atlan tenant (dev, prod) you connect. It's Phase 3 of the [IAM role guide](https://docs.atlan.com/llms/connectors/amazon-athena/connect-with-an-iam-role/llms.txt).

:::

## Which method to pick

- **Pick IAM access keys** if you're evaluating Atlan or your security policy permits long-lived keys. It's self-serve end to end - no support ticket needed.
- **Pick IAM role delegation** for production. No permanent secret is stored, access can be revoked instantly on your side, and most AWS security teams require it. Budget for the allowlist handshake.
- **Add PrivateLink** only if your organization prohibits connections to AWS's public API endpoints. It changes the network path, not the identity - you still pick keys or a role first.

:::info Athena reads from four AWS services, not one

A working Athena connection needs permissions on **Athena** (run queries), **Glue** (read the data catalog), **S3** (fetch query results from your results bucket), and sometimes **Lake Formation** and **KMS**. A connection can pass the authentication test and still fail when crawling because one of the four is missing. See [Permissions & the S3 results bucket](https://docs.atlan.com/llms/connectors/amazon-athena/permissions-and-the-s3-results-bucket/llms.txt).

:::

## See also

- [How IAM role delegation works](https://docs.atlan.com/llms/connectors/amazon-athena/how-iam-role-delegation-works/llms.txt): The 5-minute explainer - no AWS knowledge assumed. Read this if "trust policy" or "external ID" are new terms.
- [Atlan Network Details](https://docs.atlan.com/llms/governance/administration/atlan-network-details/llms.txt): What identity Atlan connects as, which values are tenant-specific, and exactly what to ask support for.
- [Connect with an IAM role](https://docs.atlan.com/llms/connectors/amazon-athena/connect-with-an-iam-role/llms.txt): Four phases, each labeled with who performs it - including the Atlan-side allowlist step.
- [Troubleshooting Athena connectivity](https://docs.atlan.com/llms/connectors/amazon-athena/troubleshooting-athena-connectivity/llms.txt): Symptom-first index with the exact error text you'll see.

---