Amazon Athena Connector

Overview

Used for OneTrust Data Discovery, the Amazon Athena connector assists with the analysis of data held in Amazon S3 buckets using standard SQL and is able to retrieve that data back to OneTrust for review.

Note:

This connector is currently under Public Preview. Contact OneTrust Support to request early access.

Pod Residency

rdbms-scanner

Connection Method

JDBC

Supported Scan Actions

Scan Type

Description

Catalog

This scan type will fetch only the meta data in the database like details of table, or column are scanned.

Catalog & Scan

This scan type will scan both metadata and data under the tables and return the appropriate terms.

Credentials and System Permissions

OneTrust recommends to adhere to your organization's security and infrastructure policy and include system engineer resources or other qualified subject matter experts to set up credentials on data sources. For specific instructions for how to enable these credentials, refer to your data source's implementation documentation, knowledge base and/or support resources.

JDBC URL

This connector requires JDBC URL with username and password credentials. To build your JDBC URL, you will need the following:

CODE 
Example: 
jdbc:awsathena://AwsRegion=us-east-2;UID=<your-access-key>;PWD=<your-secret-key>;S3OutputLocation=s3://sample-bucket/test-results

Field

Example Details

Region Code

An instance located in the eastern United States would be = us-east-2

Access Key

Found in My Security Credentials menu.

Required to input UID field.

Secret Key

Found in My Security Credentials menu.

Required to input PWD field of the connection string.

OneTrust recommends downloading a key file to have a local copy of the Secret Key

S3 Output Location

Required for connection string. Athena caches all query results to this location.

IAM Policy Requirements

The rdbms-scanner requires read-only access to the Athena database.However, due to Athena’s architecture, additional permissions are also needed for AWS Glue (which stores metadata about databases and tables) and Amazon S3 (which stores the query results and source data). You can find more details about these dependencies in the AWS guide here.

The IAM policy assigned to the service should include the following minimum set of actions:

JSON 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "athena:CreatePreparedStatement",
        "athena:DeletePreparedStatement",
        "athena:GetPreparedStatement",
        "athena:GetQueryExecution",
        "athena:GetQueryResults",
        "athena:GetQueryResultsStream",
        "athena:GetTableMetadata",
        "athena:GetWorkGroup",
        "athena:ListDataCatalogs",
        "athena:ListDatabases",
        "athena:ListTableMetadata",
        "athena:StartQueryExecution",
        "athena:UpdatePreparedStatement",
        "glue:BatchGetTable",
        "glue:GetCatalogImportStatus",
        "glue:GetDatabases",
        "glue:GetTable",
        "glue:GetTables",
        "s3:GetBucketLocation"
      ],
      "Resource": "*"
    }
  ]
}

Scan Profile Support

Note:

For additional details on scan profile configuration and management, see Setting Up Scan Profiles.

Limits

  • Number of Databases

  • Tables per Database

  • Rows per Table

Wildcard

Wildcards are not supported for column inclusion or exclusion.

  • Example: *Name* will not work to include/exclude both firstName and lastName columns

  • Instead, you must specify the exact column names separated by commas (e.g. firstName,lastName).

Important:

Columns Excluded in the Data Dictionary

When a column is excluded, it is still cataloged by the Data Dictionary. This means:

  • Basic metadata for the column is retrieved.

  • During extraction, the actual column content is skipped based on the configuration.

Include/Exclude Path Configuration Fields

  • Schema

  • Table

  • Column

Collected Objects & Fields

Objects

Fields

Databases

  • Name

Tables

  • Name

Columns

  • Name

  • Column Index (Order)

  • Comment

  • Nullable (T/F)

  • Size Estimate

  • Comment

Keys

  • Primary Key Name

  • Primary Key Columns

  • Foreign Key Name

  • Foreign Key Columns

Troubleshooting

Invalid Request Exception Error:

CODE 
Caused by: com.simba.athena.amazonaws.services.athena.model.InvalidRequestException: 
Cannot create Prepared Statement stmt3110298011. The number of Prepared Statements in 
this workGroup onetrust exceeds limit of 1000.  (Service: AmazonAthena; Status Code: 400; Error Code: InvalidRequestException; Request ID: 8d8112a1-c2ad-45aa-b21f-7980a9af04f7; Proxy: null)
	... 51 common frames omitted

Explanation

In rdbms-scanner, we create PreparedStatements to execute queries, as this is the recommended approach for interacting with databases (both for security and performance reasons).

However, Amazon Athena imposes a limit of 1000 prepared statements per workgroup, as documented here.

We use the official Athena SDK, where prepared statements are automatically deallocated when the connection is closed or when execution fails.

Solution

This issue may occur if something prevents the prepared statements from being removed automatically — for example, an insufficient permission that blocks the deletion of prepared statements.

Any permission errors must be resolved before starting the scan again. See the section IAM Policy Requirements above for details.

This issue cannot be resolved directly within the OneTrust application. Prepared statements must be manually cleaned up at the Athena workgroup level by an AWS administrator.