Athena read-only access

Allows read-only access to Athena queries and S3 data, enabling data analysis while preventing modifications.

Policy description

What this SCP does

This Service Control Policy (SCP) implements read-only access to Athena and its underlying S3 data by explicitly denying all write operations. This approach is ideal for data science teams that need to query and analyze data but should not modify Athena resources or the underlying data.

The policy uses two deny statements: one for Athena write operations (create, update, delete, etc.) and another for S3 write operations. This dual-layer protection ensures that neither Athena resources nor the underlying S3 data can be modified, while allowing all read operations by default.

Validation strategy

How to test this SCP works

To validate this SCP, test both read operations (which should be allowed by default) and write operations (which should be explicitly denied):

Allowed operations:
- List Athena query executions
- Start and get query results
- List S3 buckets and objects
Denied operations:
- Create/update/delete Athena workgroups
- Tag/untag Athena resources
- Create/delete S3 buckets
- Put/delete objects in S3

The validation tests include comprehensive checks for both Athena and S3 operations, ensuring that the policy correctly denies all write operations while allowing read access.

SCP policy & validation scenarios

{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAthenaWriteOperations", "Effect": "Deny", "Action": [ "athena:Create*", "athena:Update*", "athena:Delete*", "athena:BatchDelete*", "athena:TagResource", "athena:UntagResource" ], "Resource": "*" }, { "Sid": "DenyS3WriteOperations", "Effect": "Deny", "Action": [ "s3:PutObject", "s3:DeleteObject", "s3:CreateBucket", "s3:DeleteBucket" ], "Resource": "*" } ] }

# Test read operations (these should be allowed) aws athena list-query-executions aws athena get-query-results --query-execution-id example-id # Test write operations on Athena (these should be denied) aws athena create-work-group \ --name test-scp-workgroup \ --description "Test workgroup for SCP validation" aws athena update-work-group \ --name test-scp-workgroup \ --description "Updated description" aws athena tag-resource \ --resource-arn arn:aws:athena:region:account-id:workgroup/test-scp-workgroup \ --tags Key=Environment,Value=Test # Test write operations on S3 (these should be denied) aws s3 mb s3://test-athena-bucket aws s3api put-object --bucket existing-bucket --key test.txt --body test.txt

import boto3 # Initialize clients athena_client = boto3.client('athena') s3_client = boto3.client('s3') # Test read operations (these should be allowed) try: response = athena_client.list_query_executions() print("✅ Successfully listed Athena query executions (allowed as expected)") except Exception as e: print(f"❌ Error listing query executions (should be allowed): {e}") try: response = athena_client.start_query_execution( QueryString="SELECT 1", ResultConfiguration={ 'OutputLocation': 's3://your-query-results-bucket/path/' } ) print("✅ Successfully started query execution (allowed as expected)") except Exception as e: print(f"❌ Error starting query execution (should be allowed): {e}") # Test Athena write operations (these should be denied) try: response = athena_client.create_work_group( Name='test-scp-workgroup', Description='Test workgroup for SCP validation' ) print("❌ WARNING: Created workgroup when it should be denied") except Exception as e: print("✅ Create workgroup was denied as expected:", e) try: response = athena_client.update_work_group( WorkGroup='existing-workgroup', Description='Updated description' ) print("❌ WARNING: Updated workgroup when it should be denied") except Exception as e: print("✅ Update workgroup was denied as expected:", e) # Test S3 write operations (these should be denied) try: response = s3_client.create_bucket( Bucket='test-athena-bucket' ) print("❌ WARNING: Created S3 bucket when it should be denied") except Exception as e: print("✅ Create bucket was denied as expected:", e) try: response = s3_client.put_object( Bucket='existing-bucket', Key='test.txt', Body=b'test content' ) print("❌ WARNING: Put object to S3 when it should be denied") except Exception as e: print("✅ Put object was denied as expected:", e)