docs / destinations / athena

Amazon Athena

Amazon Athena

deployable todaymerges

Iceberg tables in S3 and the AWS Glue Data Catalog, ready to query with Athena. Supports append, replace, and merge.

Ingest lands typed, deduplicated tables in Amazon Athena from any API it connects, including Abilene TX 311, Albany NY 311, Ann Arbor MI 311 and Anne Arundel County MD 311. You own the Amazon Athena account and the credentials; Ingest keeps no copy of the data.

Every destination receives the same layout; see the tables Ingest creates.

Setup

Before you start

You need an AWS administrator and an S3 bucket in your Glue region. Ingest writes Iceberg tables through S3 and Glue. Your own Athena query identity needs separate query permissions. Copy the trust policy from the signed-in Ingest panel. Public docs contain placeholders. The signed-in panel fills your workspace's role and external ID.

1. Choose your warehouse

  • Enter s3://your-bucket/warehouse in S3 warehouse at the bottom. Replace your-bucket with your existing S3 bucket's name. warehouse is the folder prefix; keep it or choose another.
  • Enter your Glue and S3 region in AWS region at the bottom.
  • Choose a pipeline Dataset name, such as shopify. You enter it in the Glue policy in step 3, and again when you set up the pipeline. Each additional pipeline dataset needs matching grants. Connection tests use temporary test_ingest_conn_ databases.

2. Grant S3 access

  • IAM → Roles → Create role → Custom trust policy. Paste this; name the role IngestAccess-athena. The IngestAccess- prefix is required. This policy trusts only your workspace's role and external ID.
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "<ingest-tenant-role-arn>" },
    "Action": "sts:AssumeRole",
    "Condition": { "StringEquals": { "sts:ExternalId": "<your-workspace-slug>" } }
  }]
}
  • Attach this policy, with the bucket and folder prefix of your S3 warehouse filled in. On the public docs page, replace your-bucket and your-prefix yourself.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload"],
      "Resource": "arn:aws:s3:::your-bucket/your-prefix/*"
    },
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::your-bucket",
      "Condition": { "StringLike": { "s3:prefix": ["your-prefix", "your-prefix/*"] } }
    },
    {
      "Effect": "Allow",
      "Action": "s3:GetBucketLocation",
      "Resource": "arn:aws:s3:::your-bucket"
    }
  ]
}
  • Using KMS? Grant the role key access. Allow kms:GenerateDataKey and kms:Decrypt on the key. The key policy must also allow the role.
  • Paste the role's ARN into IAM role Ingest assumes (IngestAccess-…) at the bottom.

3. Grant Glue access

  • Attach this to the same role, with your AWS region, your AWS account ID and your pipeline Dataset name filled in. In the signed-in panel the account ID comes from the IngestAccess role's ARN; if your Glue catalog belongs to another account, change it in the copied policy. On the public docs page, replace your-region, your-aws-account-id and your_dataset yourself. Use the account that owns your Glue catalog, not Ingest's AWS account. Glue checks the catalog, database, tables, and functions when deleting a test database. Keep the scratch resources so the connection test can create and clean up its data.
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "glue:CreateDatabase", "glue:GetDatabase", "glue:DeleteDatabase",
      "glue:CreateTable", "glue:GetTable", "glue:GetTables",
      "glue:UpdateTable", "glue:DeleteTable"
    ],
    "Resource": [
      "arn:aws:glue:your-region:your-aws-account-id:catalog",
      "arn:aws:glue:your-region:your-aws-account-id:database/your_dataset",
      "arn:aws:glue:your-region:your-aws-account-id:table/your_dataset/*",
      "arn:aws:glue:your-region:your-aws-account-id:userDefinedFunction/your_dataset/*",
      "arn:aws:glue:your-region:your-aws-account-id:database/test_ingest_conn_*",
      "arn:aws:glue:your-region:your-aws-account-id:table/test_ingest_conn_*/*",
      "arn:aws:glue:your-region:your-aws-account-id:userDefinedFunction/test_ingest_conn_*/*"
    ]
  }]
}
  • Using Lake Formation? Ask your administrator for its grants too. IAM permissions do not override Lake Formation rules or explicit denies.

4. Test the connection

  • Click Test & configure at the bottom. Writes and reads temporary data, checks pipeline state, then attempts cleanup. Review any cleanup warning. If the test fails, fix the reported problem and choose Test again.

Staging

The worker writes Iceberg data files directly to your S3 warehouse and commits metadata in Glue. No separate staging bucket is required.

Conformance

Every adapter passes the same suite before it ships: create a table with every canonical type, append 100k rows, atomic replace, merge (latest dedup_sort wins; child tables delete-then-insert by root id), schema evolution, NULL-key rejection, package replay without duplicates, state and schema round-trip, row-count read-back, identifier edge cases, double-underscored table names (__quarantine, child tables), and rollback on a mid-load failure.

Questions

Can Ingest load data into Amazon Athena?
Yes. Amazon Athena is live on Ingest's hosted service: the adapter passes all 15 conformance cases against the real service, and the setup steps are on this page.
Does Ingest merge into Amazon Athena, or only append?
Amazon Athena merges on the resource's primary key, so re-running a sync updates existing rows rather than duplicating them. Append and full replace are available per resource.
What does Ingest need to connect to Amazon Athena?
S3 warehouse. Secrets are entered in a form, never in a chat, and held in a secret store under your own path: only the key names ever reach Ingest's database.
Which sources can Ingest load into Amazon Athena?
Every connector Ingest has certified (Abilene TX 311, Albany NY 311, Ann Arbor MI 311, Anne Arundel County MD 311, Anthropic, Asana, Auburn WA 311, Aurora IL 311, Austin TX 311, Baltimore MD 311, Baton Rouge LA 311, Beaumont TX 311, Bellevue WA 311, Bellingham WA 311, Berkeley CA 311, Bethlehem PA 311, Bloomington IN 311, Boca Raton FL 311, Boston MA 311, Bridgeport CT 311, Brockton MA 311, Brookline MA 311, Buffalo NY 311, Burlington VT 311, Cambridge MA 311, Cambridge MA Open Data, Charleston County SC 311, Charlotte NC 311, Chula Vista CA 311, Cincinnati OH 311, Chicago IL 311, New York City NY 311, Clayton County GA 311, Cleveland OH 311, Cobb County GA 311, Columbus OH 311, Corona CA 311, Dallas TX 311, Davenport IA 311, Denver CO 311, Detroit MI 311, Elgin IL 311, Encinitas CA 311, Everett WA 311, Federal Way WA 311, Fort Lauderdale FL 311, Gilbert AZ 311, Google Ad Manager, Google Analytics 4, Greenwich CT 311, Hartford CT 311, Honolulu HI 311, Houston TX 311, Howard County MD 311, Huntington WV 311, Huntsville AL 311, Indianapolis IN 311, Jersey City NJ 311, Jira, Kansas City MO 311, Kent WA 311, Knox County TN 311, Los Angeles CA 311, Lexington KY 311, Lincoln NE 311, LinkedIn Ads, Livonia MI 311, Louisville KY 311, Lubbock TX 311, Macon-Bibb County GA 311, Manchester NH 311, Maui County HI 311, Medford MA 311, Memphis TN 311, Miami FL 311, Miami-Dade County FL 311, Minneapolis MN 311, Montgomery County MD 311, Multnomah County OR 311, Naperville IL 311, Nashua NH 311, Nashville TN 311, Newark NJ 311, NOAA, New Orleans LA 311, Norfolk VA 311, Oakland CA 311, Omaha NE 311, Open Brewery DB, Paterson NJ 311, Peoria IL 311, Philadelphia PA 311, Pinellas County FL 311, Pittsburgh PA 311, PokéAPI, Portland ME 311, PostgreSQL, Prince George's County MD 311, Provo UT 311, Raleigh NC 311, Ramp, Renton WA 311, The Rick and Morty API, Sacramento CA 311, Salesforce, San Antonio TX 311, San Francisco CA 311, San Gabriel CA 311, San Jose CA 311, San Mateo County CA 311, San Rafael CA 311, Santa Fe NM 311, Scottsdale AZ 311, Seattle WA 311, Shopify, Somerville MA 311, Springfield MO 311, St. Petersburg FL 311, Tacoma WA 311, Toledo OH 311, Topeka KS 311, Vallejo CA 311, Washington DC 311, Wayne County MI 311, West Des Moines IA 311, Wichita KS 311, Worcester MA 311 and Youngstown OH 311), plus any API it authors on request. The data lands in a destination you own, under credentials you control. Ingest keeps no copy of it.

Sources certified against a real API today: Abilene TX 311, Albany NY 311, Ann Arbor MI 311, Anne Arundel County MD 311, Anthropic, Asana, Auburn WA 311, Aurora IL 311, Austin TX 311, Baltimore MD 311, Baton Rouge LA 311, Beaumont TX 311, Bellevue WA 311, Bellingham WA 311, Berkeley CA 311, Bethlehem PA 311, Bloomington IN 311, Boca Raton FL 311, Boston MA 311, Bridgeport CT 311, Brockton MA 311, Brookline MA 311, Buffalo NY 311, Burlington VT 311, Cambridge MA 311, Cambridge MA Open Data, Charleston County SC 311, Charlotte NC 311, Chula Vista CA 311, Cincinnati OH 311, Chicago IL 311, New York City NY 311, Clayton County GA 311, Cleveland OH 311, Cobb County GA 311, Columbus OH 311, Corona CA 311, Dallas TX 311, Davenport IA 311, Denver CO 311, Detroit MI 311, Elgin IL 311, Encinitas CA 311, Everett WA 311, Federal Way WA 311, Fort Lauderdale FL 311, Gilbert AZ 311, Google Ad Manager, Google Analytics 4, Greenwich CT 311, Hartford CT 311, Honolulu HI 311, Houston TX 311, Howard County MD 311, Huntington WV 311, Huntsville AL 311, Indianapolis IN 311, Jersey City NJ 311, Jira, Kansas City MO 311, Kent WA 311, Knox County TN 311, Los Angeles CA 311, Lexington KY 311, Lincoln NE 311, LinkedIn Ads, Livonia MI 311, Louisville KY 311, Lubbock TX 311, Macon-Bibb County GA 311, Manchester NH 311, Maui County HI 311, Medford MA 311, Memphis TN 311, Miami FL 311, Miami-Dade County FL 311, Minneapolis MN 311, Montgomery County MD 311, Multnomah County OR 311, Naperville IL 311, Nashua NH 311, Nashville TN 311, Newark NJ 311, NOAA, New Orleans LA 311, Norfolk VA 311, Oakland CA 311, Omaha NE 311, Open Brewery DB, Paterson NJ 311, Peoria IL 311, Philadelphia PA 311, Pinellas County FL 311, Pittsburgh PA 311, PokéAPI, Portland ME 311, PostgreSQL, Prince George's County MD 311, Provo UT 311, Raleigh NC 311, Ramp, Renton WA 311, The Rick and Morty API, Sacramento CA 311, Salesforce, San Antonio TX 311, San Francisco CA 311, San Gabriel CA 311, San Jose CA 311, San Mateo County CA 311, San Rafael CA 311, Santa Fe NM 311, Scottsdale AZ 311, Seattle WA 311, Shopify, Somerville MA 311, Springfield MO 311, St. Petersburg FL 311, Tacoma WA 311, Toledo OH 311, Topeka KS 311, Vallejo CA 311, Washington DC 311, Wayne County MI 311, West Des Moines IA 311, Wichita KS 311, Worcester MA 311, Youngstown OH 311.

Other destinations Ingest writes to: Amazon S3, Google Cloud Storage, Azure Blob Storage, Apache Iceberg, Ingest Managed Lakehouse, MotherDuck, Postgres, Databricks, Redshift, BigQuery, ClickHouse, MySQL / generic SQL, Snowflake.

Get your API data into Amazon Athena