Amazon Athena Connection Details

Introduction

Connector Version

This documentation is based on version 25.0.9368 of the connector.

Get Started

Amazon Athena Version Support

The Amazon Athena connector connects with the Amazon Athena Web Services API.

Establish a Connection

Connect to Amazon Athena

To connect to data, specify these basic connection parameters:

• DataSource: The Amazon Athena data source to connect to.
• Database: The Amazon Athena database to connect to.
• AWSRegion: The region where your Amazon Athena data is hosted.
• S3StagingDirectory: The S3 folder where you want to store the results of queries.

If Database and DataSource are not specified, the connector tries to list all databases from the available data sources in Amazon Athena. Setting both properties improves the performance of the connector.

Authenticate to Amazon Athena

Amazon Athena connector supports a wide range of authentication options. The following sections discuss each option.

Obtain AWS Keys

To obtain the credentials for an IAM user:

1. Sign into the IAM console.
2. In the navigation pane, select Users.
3. To create or manage the access keys for a user, select the user and then navigate to the Security Credentials tab.

To obtain the credentials for your AWS root account:

1. Sign into the AWS Management console with the credentials for your root account.
2. Select your account name or number.
3. In the menu that displays, select My Security Credentials.
4. To manage or create root account access keys, click Continue to Security Credentials and expand the "Access Keys" section.

Root Credentials

To authenticate using account root credentials, set these parameters:

• AuthScheme: AwsRootKeys.
• AWSAccessKey: The access key associated with the AWS root account.
• AWSSecretKey: The secret key associated with the AWS root account.

If multi-factor authentication is required, specify the following:

• CredentialsLocation: The location of the settings file where MFA credentials are saved. See the Credentials File Location page under Connection String Options for more information.
• MFASerialNumber: The serial number of the MFA device if one is being used.
• MFAToken: The temporary token available from your MFA device.

This causes the connector to submit the MFA credentials in the request to retrieve temporary authentication credentials.

Temporary Credentials

To authenticate using temporary credentials, specify the following:

• AuthScheme: TemporaryCredentials.
• AWSAccessKey: The access key of the IAM user who will assume the role.
• AWSSecretKey: The secret key of the IAM user who will assume the role.
• AWSSessionToken: Your AWS session token, provided with your temporary credentials. For details, see AWS Identity and Access Management User Guide.

The connector can now request resources using the same permissions provided by long-term credentials (such as IAM user credentials) for the lifespan of the temporary credentials.

To authenticate using both temporary credentials and an IAM role, set all the parameters described above, and specify these additional parameters:

• AWSRoleARN: The Role ARN for the role you'd like to authenticate with. This prompts the connector to retrieve credentials for the specified role.
• AWSExternalId (optional): Only required if you are assuming a role in another AWS account.

If multi-factor authentication is required, specify the following:

• CredentialsLocation: The location of the settings file where MFA credentials are saved. See the Credentials File Location page under Connection String Options for more information.
• MFASerialNumber: The serial number of the MFA device if one is being used.
• MFAToken: The temporary token available from your MFA device.

This causes the connector to submit the MFA credentials in the request to retrieve temporary authentication credentials.

EC2 Instances

Set AuthScheme to AwsEC2Roles.

If you are using the connector from an EC2 Instance and have an IAM Role assigned to the instance, you can use the IAM Role to authenticate. Since the connector automatically obtains your IAM Role credentials and authenticates with them, it is not necessary to specify AWSAccessKey and AWSSecretKey.

If you are also using an IAM role to authenticate, you must additionally specify the following:

• AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This will cause the connector to attempt to retrieve credentials for

  the specified role.

• AWSExternalId (optional): Only required if you are assuming a role in another AWS account.

IMDSv2 Support

The Amazon Athena connector now supports IMDSv2. Unlike IMDSv1, the new version requires an authentication token. Endpoints and response are the same in both versions.

In IMDSv2, the Amazon Athena connector first attempts to retrieve the IMDSv2 metadata token and then uses it to call AWS metadata endpoints. If it is unable to retrieve the token, the connector reverts to IMDSv1.

AWS Web Identity

Set AuthScheme to AwsWebIdentity.

If you are either using Amazon Athena from a container configured to assume role with web identity (such as a Pod in an EKS cluster with an OpenID Provider) OR have authenticated with a web identity provider associated with an IAM role (and have thus obtained an identity token), you can exchange the web identity token and IAM role information for temporary security credentials to authenticate and access AWS services.

If the container has AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE specified in the environment variables, Amazon Athena automatically obtains the credentials.

You can also authenticate by specifying both AWSRoleARN and AWSWebIdentityToken to execute the AssumeRoleWithWebIdentity API operation.

{: #section}

AWS IAM Roles

Set AuthScheme to AwsIAMRoles.

In some circumstances it may be preferable to use an IAM role for authentication, rather than use the direct security credentials of an AWS root user. If you are specifying the AWSAccessKey and AWSSecretKey of an AWS root user, you may not use roles.

To authenticate as an AWS role, set these properties:

• AWSAccessKey: The access key of the IAM user to assume the role for.

• AWSSecretKey: The secret key of the IAM user to assume the role for.

• AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This will cause the connector to attempt to retrieve credentials for the specified role.

• AWSExternalId (optional): Only required if you are assuming a role in another AWS account.

If multi-factor authentication is required, specify the following:

• CredentialsLocation: The location of the settings file where MFA credentials are saved. See the Credentials File Location page under Connection String Options for more information.
• MFASerialNumber: The serial number of the MFA device if one is being used.
• MFAToken: The temporary token available from your MFA device.

This causes the connector to submit the MFA credentials in the request to retrieve temporary authentication credentials.

ADFS

To connect to ADFS, set these properties:

• AuthScheme: ADFS.
• User: The authenticating ADFS user.
• Password: The password of the authenticating ADFS user.
• SSOLoginURL: The SSO provider's login URL.

Example connection string:

AuthScheme=ADFS; AWSRegion=Ireland; Database=sampledb; User=user@cdata.com; Password=CH8WerW121235647iCa6; SSOLoginURL='https://adfs.domain.com'; AWSRoleArn=arn:aws:iam:1234:role/ADFS_SSO; AWSPrincipalArn=arn:aws:iam:1234:saml-provider/ADFSProvider; S3StagingDirectory=s3://athena/staging;

Okta

To connect to Okta, set these properties:

• AuthScheme: Okta.
• User: The authentiating Okta user.
• Password: The password of the authenticating Okta user.
• SSOLoginURL: The SSO provider's login URL.

If you are either using a trusted application or proxy that overrides the Okta client request OR configuring MFA, you must use combinations of SSOProperties to authenticate using Okta. Set any of the following, as applicable:

• APIToken: When authenticating a user via a trusted application or proxy that overrides the Okta client request context, set this to the API Token the customer created from the Okta organization.

• MFAType: If you have configured the MFA flow, set this to one of the following supported types: OktaVerify, Email, or SMS.

• MFAPassCode: If you have configured the MFA flow, set this to a valid passcode.

  If you set this to empty or an invalid value, the connector issues a one-time password challenge to your device or email. After the passcode is received, reopen the connection where the retrieved one-time password value is set to the MFAPassCode connection property.

• MFARememberDevice: True by default. Okta supports remembering devices when MFA is required. If remembering devices is allowed according to the configured authentication policies, the connector sends a device token to extend MFA authentication lifetime. If you do not want MFA to be remembered, set this variable to False.

Example connection string:

AuthScheme=Okta; AWSRegion=Ireland; Database=sampledb; User=user@cdata.com; Password=CH8WerW121235647iCa6; SSOLoginURL='https://cdata-us.okta.com/home/amazon_aws/0oa35m8arsAL5f5NrE6NdA356/272'; SSOProperties='ApiToken=01230GGG2ceAnm_tPAf4MhiMELXZ0L0N1pAYrO1VR-hGQSf;'; AWSRoleArn=arn:aws:iam:1234:role/Okta_SSO; AWSPrincipalARN=arn:aws:iam:1234:saml-provider/OktaProvider; S3StagingDirectory=s3://athena/staging;

PingFederate

To connect to PingFederate, set these properties:

• AuthScheme: PingFederate.
• User: The authenticating PingFederate user.
• Password: The authenticating user's PingFederate password.
• SSOLoginURL: The SSO provider's login URL.
• AWSRoleARN (optional): If you have multiple role ARNs, specify the one you want to use for authorization.
• AWSPrincipalARN (optional): If you have multiple principal ARNs, specify the one you want to use for authorization.
• SSOExchangeURL: The Partner Service Identifier URI configured in your PingFederate server instance under: SP Connections > SP Connection > WS-Trust > Protocol Settings. This should uniquely identify a PingFederate SP Connection, so it is a good idea to set it to your AWS SSO ACS URL. You can find it under AWS SSO > Settings > View Details next to the Authentication field.
• SSOProperties (optional): If you want to include your username and password as an authorization header in requests to Amazon S3, set this to Authscheme=Basic.

To enable mutual SSL authentication for SSOLoginURL, the WS-Trust STS endpoint, configure these SSOProperties:

• SSLClientCert
• SSLClientCertType
• SSLClientCertSubject
• SSLClientCertPassword

Example connection string:

authScheme=pingfederate;SSOLoginURL=https://mycustomserver.com:9033/idp/sts.wst;SSOExchangeUrl=https://us-east-1.signin.aws.amazon.com/platform/saml/acs/764ef411-xxxxxx;user=admin;password=PassValue;AWSPrincipalARN=arn:aws:iam:215338515180:saml-provider/pingFederate;AWSRoleArn=arn:aws:iam:215338515180:role/SSOTest2;AWSRegion=Ireland;S3StagingDirectory=s3://somedirectory/staging;Database=athenadatabase;

Credentials Files

You can use any credentials file to authenticate, including any configurations related to AccessKey/SecretKey authentication, temporary credentials, role authentication, or MFA.

To do this, set these properties:

• AuthScheme: AwsCredentialsFile.
• AWSCredentialsFile: The location of your credentials file.
• AWSCredentialsFileProfile (optional): The name of the profile you would like to use from the specified credentials file. If not specified, the default profile is used.

For further information, see AWS Command Line Interface User Guide.

AWS Cognito Credentials

If you want to use the connector with a user registered in a User Pool in AWS Cognito, set these properties:

• AuthScheme: Either AwsCognitoSrp (recommended) or AwsCognitoBasic.
• AWSCognitoRegion: The User Pool region.
• AWSUserPoolId: The User Pool ID.
• AWSUserPoolClientAppId: The User Pool Client App ID.
• AWSUserPoolClientAppSecret: The User Pool Client Secret.
• AWSIdentityPoolId: The Identity Pool ID of the Identity Pool that is linked with the User Pool.
• User: The username of the user registered in the User Pool.
• Password: The password of the user registered in the User Pool.

Microsoft Entra ID

This configuration uses the OAuth 2.0 On-Behalf-Of flow (Microsoft identity platform and OAuth 2.0 On-Behalf-Of flow ), which requires two Microsoft Entra applications:

• the Amazon Athena application used for single sign-on
• a separate "connector" application with user_impersonation permission on the Amazon Athena application

Create the SSO Application

Follow the steps outlined in Microsoft's AWS Single-Account Access documentation to create the SSO application and set Microsoft Entra ID as the SAML IdP for an AWS single-account app.

To create an application with user_impersonation permission on the SSO application, follow these steps:

1. Sign into the Microsoft Entra admin center as at least a Cloud Application Administrator.
2. Navigate to Identity > Applications > App registrations.
3. Click New application at the top of the page.
4. Enter a name and select supported account types as desired.
5. Select Web in the Redirect URI dropdown, and enter http://localhost:33333.
6. Select Register.
7. In the "Overview" section, you can see your OAuthClientId (Application ID).
8. Select API permissions > Add a permission.
9. Select the API of your SSO application by specifying its name or Application ID in the "APIs my organization uses" tab.
10. Select user_impersonation from the available list of Permissions.
11. Select Add permissions.
12. Select Certificates & secrets.
13. Select New client secret.
14. Optionally, enter a description and change the default Expires value, then select Add.
15. Save your client secret (the Value field of the OAuth secret that is displayed).

After configuring both applications, specify the following OAuth connection properties to connect with the driver:

• OAuthClientId: The application ID of the connector application, listed in the Overview section of the application registration.
• OAuthClientSecret : The client secret value of the connector application. Microsoft Entra ID displays this when you create a new client secret.
• CallbackURL: Set this to the redirect URI of the connector application. For example: https://localhost:33333.
• InitiateOAuth: GETANDREFRESH.

Use these SSO Properties to authenticate to Microsoft Entra ID:

• Resource: The application ID URI of the Amazon Athena application, listed in the Overview section of the application registration. In most cases this is the URL of your custom Amazon Athena domain.
• AzureTenant: The ID of the Microsoft Entra ID tenant where the applications are registered.

Example connection string:

AuthScheme=Microsoft Entra ID;InitiateOAuth=GETANDREFRESH;OAuthClientId=3ea1c786-d527-4399-8c3b-2e3696ae4b48;OauthClientSecret=xxx;CallbackUrl=https://localhost:33333;SSOProperties='Resource=https://signin.aws.amazon.com/saml;AzureTenant=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx';

Fine-Tuning Data Access

Customize Amazon Athena Behavior

Follow the steps below to configure the connector defaults for querying Amazon Athena.

Use QueryPassthrough

Amazon Athena supports a set of queries that are not specified in the regular SQL-92 standard; to execute these queries simply set QueryPassthrough to true. This will pass the query directly to Amazon Athena without parsing it internally.

Flatten Nested Objects and Arrays

The connector is capable of flattening array elements and object properties into columns. See the pages for FlattenArrays and FlattenObjects for more information.

Encrypt Query Results to S3

Set EncryptionKey and EncryptionType if you would like to encrypt the result set stored in S3 after query execution.

To encrypt results stored in S3, follow the steps below:

1. Navigate to Amazon Athena Console.
2. Click Settings.
3. Enable the Encrypt Query Results option.
4. Select the Encryption type and set EncryptionType when you connect.
5. If you selected SSE-KMS or CSE-KMS, set both EncryptionType and EncryptionKey: select an encryption key in the menu or click Create KMS Key.

Performance

Clean Query Results

Amazon Athena stores the results of every query you execute in CSV files in S3StagingDirectory; these can quickly rack up a lot of space in Amazon S3. You can use CleanQueryResults, enabled by default, to clean these files for every query executed.

Note that this behavior will add a minor performance hit when you disconnect the last connection in a process.

Use Athena's Query Caching

You configure QueryCachingLevel to modify the usage of the query results stored in S3StagingDirectory; note that you have to keep the connection open to benefit from this feature. This is especially helpful when executing a certain query multiple times. This means Amazon Athena will not scan the same data again and simply use the results from the previous execution. These results are cleaned in the amount of seconds specified in QueryTolerance.

Note that failing to properly disconnect the connection when QueryCachingLevel is set to Cloud may lead to a large amount of saved queries in Athena. For most use cases setting QueryCachingLevel to Local should be enough.

Fine Tuning Performance

You can use the PageSize property to optimize use of your provisioned throughput, based on the size of your items and Amazon Athena's 1000MB page size. Set this property to the number of items to return.

Generally, a smaller page size reduces spikes in throughput that cause throttling. A smaller page size also inserts pauses between requests. This interval evens out the distribution of requests and allows more requests to be successful by avoiding throttling.

Minimum IAM Permissions

We recommend using predefined roles for services rather than creating custom IAM policies, but it if you want to create custom polices, use the roles described in the table below. Note that the specific policies required by the Amazon Athena driver are subject to change in future releases. Amazon Athena requires at a minimum the following permissions:

"arn:aws:athena:us-east-1:987654321098:datacatalog/*"

            "Resource": [
"arn:aws:glue:region123:111111111111:table/*/*",
"arn:aws:glue:region123:111111111111:database/*",
"arn:aws:glue:region123:111111111111:catalog"
]

Federated Queries

If you are using federated queries, i.e., using Lambda functions to get data from other sources, you need Lambda permissions as well. For example, to give lambda:InvokeFunction permissions on a resource with the name cloudwatchtest1 in Northern Virginia:

{
"Effect": "Allow",
"Action": [
"lambda:InvokeFunction"
],
"Resource": [
"arn:aws:lambda:us-east-1:987654321098:function:cloudwatchtest1"
]
}

Only the Lambda permission is optional. All the other permissions are required to do a simple SELECT with the driver.

Important Notes

Configuration Files and Their Paths

• All references to adding configuration files and their paths refer to files and locations on the Jitterbit agent where the connector is installed. These paths are to be adjusted as appropriate depending on the agent and the operating system. If multiple agents are used in an agent group, identical files will be required on each agent.

Advanced Features

This section details a selection of advanced features of the Amazon Athena connector.

User Defined Views

The connector supports the use of user defined views, virtual tables whose contents are decided by a pre-configured user defined query. These views are useful when you cannot directly control queries being issued to the drivers. For an overview of creating and configuring custom views, see User Defined Views.

SSL Configuration

Use SSL Configuration to adjust how connector handles TLS/SSL certificate negotiations. You can choose from various certificate formats. For further information, see the SSLServerCert property under "Connection String Options".

Proxy

To configure the connector using private agent proxy settings, select the Use Proxy Settings checkbox on the connection configuration screen.

Query Processing

The connector offloads as much of the SELECT statement processing as possible to Amazon Athena and then processes the rest of the query in memory (client-side).

For further information, see Query Processing.

Log

For an overview of configuration settings that can be used to refine logging, see Logging. Only two connection properties are required for basic logging, but there are numerous features that support more refined logging, which enables you to use the LogModules connection property to specify subsets of information to be logged.

User Defined Views

The Amazon Athena connector supports the use of user defined views: user-defined virtual tables whose contents are decided by a preconfigured query. User defined views are useful in situations where you cannot directly control the query being issued to the driver; for example, when using the driver from Jitterbit.

Use a user defined view to define predicates that are always applied. If you specify additional predicates in the query to the view, they are combined with the query already defined as part of the view.

There are two ways to create user defined views:

• Create a JSON-formatted configuration file defining the views you want.
• DDL statements.

Define Views Using a Configuration File

User defined views are defined in a JSON-formatted configuration file called UserDefinedViews.json. The connector automatically detects the views specified in this file.

You can also have multiple view definitions and control them using the UserDefinedViews connection property. When you use this property, only the specified views are seen by the connector.

This user defined view configuration file is formatted so that each root element defines the name of a view, and includes a child element, called query, which contains the custom SQL query for the view.

For example:

{
    "MyView": {
        "query": "SELECT * FROM [AwsDataCatalog].[sampledb].Customers WHERE MyColumn = 'value'"
    },
    "MyView2": {
        "query": "SELECT * FROM MyTable WHERE Id IN (1,2,3)"
    }
}

Use the UserDefinedViews connection property to specify the location of your JSON configuration file. For example:

"UserDefinedViews", "C:\Users\yourusername\Desktop\tmp\UserDefinedViews.json"

Define Views Using DDL Statements

The connector is also capable of creating and altering the schema via DDL Statements such as CREATE LOCAL VIEW, ALTER LOCAL VIEW, and DROP LOCAL VIEW.

Create a View

To create a new view using DDL statements, provide the view name and query as follows:

CREATE LOCAL VIEW [MyViewName] AS SELECT * FROM Customers LIMIT 20;

If no JSON file exists, the above code creates one. The view is then created in the JSON configuration file and is now discoverable. The JSON file location is specified by the UserDefinedViews connection property.

Alter a View

To alter an existing view, provide the name of an existing view alongside the new query you would like to use instead:

ALTER LOCAL VIEW [MyViewName] AS SELECT * FROM Customers WHERE TimeModified > '3/1/2020';

The view is then updated in the JSON configuration file.

Drop a View

To drop an existing view, provide the name of an existing schema alongside the new query you would like to use instead.

DROP LOCAL VIEW [MyViewName]

This removes the view from the JSON configuration file. It can no longer be queried.

Schema for User Defined Views

In order to avoid a view's name clashing with an actual entity in the data model, user defined views are exposed in the UserViews schema by default. To change the name of the schema used for UserViews, reset the UserViewsSchemaName property.

Work with User Defined Views

For example, a SQL statement with a user defined view called UserViews.RCustomers only lists customers in Raleigh:

SELECT * FROM Customers WHERE City = 'Raleigh';

An example of a query to the driver:

SELECT * FROM UserViews.RCustomers WHERE Status = 'Active';

Resulting in the effective query to the source:

SELECT * FROM Customers WHERE City = 'Raleigh' AND Status = 'Active';

That is a very simple example of a query to a user defined view that is effectively a combination of the view query and the view definition. It is possible to compose these queries in much more complex patterns. All SQL operations are allowed in both queries and are combined when appropriate.

SSL Configuration

Customize the SSL Configuration

By default, the connector attempts to negotiate TLS with the server. The server certificate is validated against the default system trusted certificate store. You can override how the certificate gets validated using the SSLServerCert connection property.

To specify another certificate, see the SSLServerCert connection property.

Data Model

Stored Procedures

Stored Procedures are function-like interfaces to Amazon Athena. They can be used to search, update, and modify information in Amazon Athena.

System Tables

System tables are a -provided set of tables that contain driver metadata. You can use system tables to access schema information, data source functionality, and batch operation statistics.

Modeling Objects

Amazon Athena Connector Data Model

The connector dynamically extracts all relevant schema information from Amazon Athena via the REST API.

Discovering Schemas

By default, all Amazon Athena entities will be exposed as views. However, the connector is also capable of dividing object types into the following types from the Amazon Athena API :

• TABLE
• VIEW
• EXTERNAL_TABLE
• MANAGED_TABLE
• VIRTUAL_VIEW

You can enable this functionality by setting MetadataDiscoveryMethod to Glue. This method will require you to also add the necessary IAM profiles for the user.

Alternatively, you can use the Athena discovery method, though this method is slower.

• MetadataDiscoveryMethod: Set this to Athena.
• IncludeTableTypes: Set this to True.

Note that while the connector can break Amazon Athena objects into these types, they are all considered to be read-only. Reconnect to load any changes in the metadata, such as added or removed columns or changes in data type.

Stored Procedures

Stored procedures are function-like interfaces that extend the functionality of the connector beyond simple SELECT/INSERT operations with Amazon Athena.

Stored procedures accept a list of parameters, perform their intended function, and then return any relevant response data from Amazon Athena, along with an indication of whether the procedure succeeded or failed.

Amazon Athena Connector Stored Procedures

CreateSchema

Creates a schema file for the specified table or view.

CreateSchema

Creates a local schema file (.rsd) from an existing table or view in the data model.

The schema file is created in the directory set in the Location connection property when this procedure is executed. You can edit the file to include or exclude columns, rename columns, or adjust column datatypes.

The connector checks the Location to determine if the names of any .rsd files match a table or view in the data model. If there is a duplicate, the schema file will take precedence over the default instance of this table in the data model. If a schema file is present in Location that does not match an existing table or view, a new table or view entry is added to the data model of the connector.

Input

Result Set Columns

GetOAuthAccessToken

If using a Windows application, set Authmode to App. If using a Web app, set Authmode to Web and specify the Verifier obtained by GetOAuthAuthorizationUrl.

Input

Result Set Columns

GetOAuthAuthorizationURL

Gets the authorization URL.

Input

Result Set Columns

RefreshOAuthAccessToken

Refreshes the OAuth token or session ID after the session has expired. Your OAuth application must have the refresh_token scope enabled.

Input

Result Set Columns

System Tables

You can query the system tables described in this section to access schema information, information on data source functionality, and batch operation statistics.

Schema Tables

The following tables return database metadata for Amazon Athena:

• sys_catalogs: Lists the available databases.
• sys_schemas: Lists the available schemas.
• sys_tables: Lists the available tables and views.
• sys_tablecolumns: Describes the columns of the available tables and views.
• sys_procedures: Describes the available stored procedures.
• sys_procedureparameters: Describes stored procedure parameters.
• sys_keycolumns: Describes the primary and foreign keys.
• sys_indexes: Describes the available indexes.

Data Source Tables

The following tables return information about how to connect to and query the data source:

• sys_connection_props: Returns information on the available connection properties.
• sys_sqlinfo: Describes the SELECT queries that the connector can offload to the data source.

Query Information Tables

The following table returns query statistics for data modification queries, including batch operations:

• sys_identity: Returns information about batch operations or single updates.

sys_catalogs

Lists the available databases.

The following query retrieves all databases determined by the connection string:

SELECT * FROM sys_catalogs

Columns

sys_schemas

Lists the available schemas.

The following query retrieves all available schemas:

SELECT * FROM sys_schemas

Columns

sys_tables

Lists the available tables.

The following query retrieves the available tables and views:

SELECT * FROM sys_tables

Columns

sys_tablecolumns

Describes the columns of the available tables and views.

The following query returns the columns and data types for the [AwsDataCatalog].[sampledb].Customers table:

SELECT ColumnName, DataTypeName FROM sys_tablecolumns WHERE TableName='Customers' AND CatalogName='AwsDataCatalog' AND SchemaName='sampledb'

Columns

sys_procedures

Lists the available stored procedures.

The following query retrieves the available stored procedures:

SELECT * FROM sys_procedures

Columns

sys_procedureparameters

Describes stored procedure parameters.

The following query returns information about all of the input parameters for the SelectEntries stored procedure:

SELECT * FROM sys_procedureparameters WHERE ProcedureName = 'SelectEntries' AND Direction = 1 OR Direction = 2

To include result set columns in addition to the parameters, set the IncludeResultColumns pseudo column to True:

SELECT * FROM sys_procedureparameters WHERE ProcedureName = 'SelectEntries' AND IncludeResultColumns='True'

Columns

Pseudo-Columns

sys_keycolumns

Describes the primary and foreign keys.

The following query retrieves the primary key for the [AwsDataCatalog].[sampledb].Customers table:

SELECT * FROM sys_keycolumns WHERE IsKey='True' AND TableName='Customers' AND CatalogName='AwsDataCatalog' AND SchemaName='sampledb'

Columns

sys_foreignkeys

Describes the foreign keys.

The following query retrieves all foreign keys which refer to other tables:

SELECT * FROM sys_foreignkeys WHERE ForeignKeyType = 'FOREIGNKEY_TYPE_IMPORT'

Columns

sys_primarykeys

Describes the primary keys.

The following query retrieves the primary keys from all tables and views:

SELECT * FROM sys_primarykeys

Columns

sys_indexes

Describes the available indexes. By filtering on indexes, you can write more selective queries with faster query response times.

The following query retrieves all indexes that are not primary keys:

SELECT * FROM sys_indexes WHERE IsPrimary='false'

Columns

sys_connection_props

Returns information on the available connection properties and those set in the connection string.

The following query retrieves all connection properties that have been set in the connection string or set through a default value:

SELECT * FROM sys_connection_props WHERE Value <> ''

Columns

sys_sqlinfo

Describes the SELECT query processing that the connector can offload to the data source.

Discovering the Data Source's SELECT Capabilities

Below is an example data set of SQL capabilities. Some aspects of SELECT functionality are returned in a comma-separated list if supported; otherwise, the column contains NO.

The following query retrieves the operators that can be used in the WHERE clause:

SELECT * FROM sys_sqlinfo WHERE Name = 'SUPPORTED_OPERATORS'

Note that individual tables may have different limitations or requirements on the WHERE clause; refer to the Data Model section for more information.

Columns

sys_identity

Returns information about attempted modifications.

The following query retrieves the Ids of the modified rows in a batch operation:

SELECT * FROM sys_identity

Columns

sys_information

Describes the available system information.

The following query retrieves all columns:

SELECT * FROM sys_information

Columns

Advanced Configurations Properties

The advanced configurations properties are the various options that can be used to establish a connection. This section provides a complete list of the options you can configure. Click the links for further details.

Authentication

Connection

AWS Authentication

SSO

OAuth

SSL

Schema

Miscellaneous

Authentication

This section provides a complete list of authentication properties you can configure.

AthenaVPCEndpoint

Your Athena VPC Endpoint. It will override the default athena.{region}.amazonaws.com endpoint.

Data Type

string

Default Value

""

Remarks

Your Athena VPC Endpoint. It will override the default athena.{region}.amazonaws.com endpoint.

S3StagingDirectory

Specifies the location Amazon Athena will use to store the results of a query.

Data Type

string

Default Value

""

Remarks

Specifies the location Amazon Athena will use to store the results of a query. This folder can occupy space over the course of time and you may want to clean it manually if CleanQueryResults is not enabled.

EncryptionType

Specifies the encryption option for query results in Athena.

Possible Values

None, SSE_S3, SSE_KMS, CSE_KMS

Data Type

string

Default Value

None

Remarks

Specifies the encryption option for query results in Athena. This option is required if you have configured Amazon Athena to encrypt query results; Set EncryptionType and EncryptionKey if you would like to encrypt the result set stored in S3 after query execution. Note that setting these properties does not encrypt the result set in S3StagingDirectory.

To encrypt Amazon Athena query results, follow the following steps:

1. Navigate to Amazon Athena Console.
2. Click Settings.
3. Enable the Encrypt Query Results option.
4. Select the Encryption type.
5. If you selected SSE-KMS or CSE-KMS, select an encryption key in the menu or click Create KMS Key. Set EncryptionKey in addition to EncryptionType when you connect.

EncryptionKey

Specifies the encryption key when encrypting results stored in S3.

Data Type

string

Default Value

""

Remarks

Specifies the encryption key when encrypting results stored in S3. This option is required if the EncryptionType is set to SSE_KMS or CSE_KMS.

Set EncryptionType and EncryptionKey if you would like to encrypt the result set stored in S3 after query execution. Note that this does not encrypt the result set in S3StagingDirectory.

Enabling Encryption

To enable the encryption of results stored in S3, see Fine-Tuning Data Access.

Obtaining an Encryption Key

You can create a key when you enable encryption. Or, create a key in the IAM console: Click Encryption Keys, select a region, and then click Create Key. To obtain the key, sign into the AWS Management console and click Services -> IAM -> Encryption Keys -> Create Key.

DataSource

The name of the Athena Data Source.

Data Type

string

Default Value

""

Remarks

The data source to connect to when querying Athena. For MetadataDiscoveryMethod=Glue, AwsDataCatalog is used as the default data source.

Database

The name of the Athena database.

Data Type

string

Default Value

""

Remarks

The database to connect to when querying Athena.

Connection

This section provides a complete list of connection properties you can configure.

CrossAccountId

The Account ID to use when retrieving metadata from Glue. Default is current account id.

Data Type

string

Default Value

""

Remarks

When the property MetadataDiscoveryMethod has been set to 'Glue' then user is able to specify a Cross Account ID which they have permissions to access, and this account will be used to retrieve metadata. See more information here: https://docs.aws.amazon.com/glue/latest/dg/cross-account-access.html

SimpleUploadLimit

This setting specifies the threshold, in bytes, above which the provider will choose to perform a multipart upload rather than uploading everything in one request.

Data Type

string

Default Value

""

Remarks

This setting specifies the threshold, in bytes, above which the connector will choose to perform a multipart upload rather than uploading everything in one request.

UseLakeFormation

When this property is set to true, AWSLakeFormation service will be used to retrieve temporary credentials, which enforce access policies against the user based on the configured IAM role. The service can be used when authenticating through OKTA, ADFS, Microsoft Entra ID, PingFederate, while providing a SAML assertion.

Data Type

bool

Default Value

false

Remarks

When this property is set to true, AWSLakeFormation service will be used to retrieve temporary credentials, which enforce access policies against the user based on the configured IAM role. The service can be used when authenticating through OKTA, ADFS, Microsoft Entra ID, PingFederate, while providing a SAML assertion.

AWS Authentication

This section provides a complete list of AWS authentication properties you can configure.

AuthScheme

Specifies the type of authentication to use when connecting to Amazon Athena. If this property is left blank, the default authentication is used.

Possible Values

ADFS, AwsRootKeys, AwsIAMRoles, AwsEC2Roles, AwsWebIdentity, AwsCredentialsFile, Okta, Keycloak, TemporaryCredentials, PingFederate, AwsCognitoBasic, AwsCognitoSrp, Microsoft Entra ID

Data Type

string

Default Value

AwsRootKeys

Remarks

• TemporaryCredentials: Authenticate using temporary security credentials alongside a session token.
• AwsRootKeys: Authenticate using the root user access key and secret, to test something quickly. (Production use cases are encouraged to use something with narrowed permissions.)
• AwsIAMRoles: Authenticate using IAM Roles.
• AwsEC2Roles: Automatically use IAM Roles assigned to the EC2 machine where connector is currently running.
• Okta: Set to use a single sign on connection with OKTA as the identity provider.
• ADFS: Set to use a single sign on connection with ADFS as the identity provider.
• PingFederate: Set to use a single sign on connection with PingFederate as the identity provider.
• AwsCredentialsFile: Set to use a credential file for authentication.
• AwsCognitoSrp: Set to use Cognito based authentication. This is recommended over AwsCognitoBasic because this option does NOT send the password to the server for authentication, instead it uses the SRP protocol.
• AwsCognitoBasic: Set to use Cognito based authentication.

AWSAccessKey

Specifies your AWS account access key. This value is accessible from your AWS security credentials page.

Data Type

string

Default Value

""

Remarks

To find your AWS account access key:

1. Sign into the AWS Management console with the credentials for your root account.
2. Select your account name or number.
3. Select My Security Credentials in the menu.
4. Click Continue to Security Credentials.
5. To view or manage root account access keys, expand the Access Keys section.

AWSSecretKey

Your AWS account secret key. This value is accessible from your AWS security credentials page.

Data Type

string

Default Value

""

Remarks

Your AWS account secret key. This value is accessible from your AWS security credentials page:

1. Sign into the AWS Management console with the credentials for your root account.
2. Select your account name or number and select My Security Credentials in the menu that is displayed.
3. Click Continue to Security Credentials and expand the Access Keys section to manage or create root account access keys.

AWSRoleARN

The Amazon Resource Name of the role to use when authenticating.

Data Type

string

Default Value

""

Remarks

When authenticating outside of AWS, it is common to use a Role for authentication instead of your direct AWS account credentials. Entering the AWSRoleARN will cause the Amazon Athena connector to perform a role based authentication instead of using the AWSAccessKey and AWSSecretKey directly. The AWSAccessKey and AWSSecretKey must still be specified to perform this authentication. You cannot use the credentials of an AWS root user when setting RoleARN. The AWSAccessKey and AWSSecretKey must be those of an IAM user.

AWSPrincipalARN

The ARN of the SAML Identity provider in your AWS account.

Data Type

string

Default Value

""

Remarks

The ARN of the SAML Identity provider in your AWS account.

AWSRegion

The hosting region for your Amazon Web Services.

Possible Values

OHIO, NORTHERNVIRGINIA, NORTHERNCALIFORNIA, OREGON, CAPETOWN, HONGKONG, HYDERABAD, JAKARTA, MALAYSIA, MELBOURNE, MUMBAI, OSAKA, SEOUL, SINGAPORE, SYDNEY, THAILAND, TOKYO, CENTRAL, CALGARY, BEIJING, NINGXIA, FRANKFURT, IRELAND, LONDON, MILAN, PARIS, SPAIN, STOCKHOLM, ZURICH, TELAVIV, MEXICOCENTRAL, BAHRAIN, UAE, SAOPAULO, GOVCLOUDEAST, GOVCLOUDWEST, ISOLATEDUSEAST, ISOLATEDUSEASTB, ISOLATEDUSEASTF, ISOLATEDUSSOUTHF, ISOLATEDUSWEST, ISOLATEDEUWEST

Data Type

string

Default Value

NORTHERNVIRGINIA

Remarks

The hosting region for your Amazon Web Services. Available values are OHIO, NORTHERNVIRGINIA, NORTHERNCALIFORNIA, OREGON, CAPETOWN, HONGKONG, HYDERABAD, JAKARTA, MALAYSIA, MELBOURNE, MUMBAI, OSAKA, SEOUL, SINGAPORE, SYDNEY, THAILAND, TOKYO, CENTRAL, CALGARY, BEIJING, NINGXIA, FRANKFURT, IRELAND, LONDON, MILAN, PARIS, SPAIN, STOCKHOLM, ZURICH, TELAVIV, MEXICOCENTRAL, BAHRAIN, UAE, SAOPAULO, GOVCLOUDEAST, GOVCLOUDWEST, ISOLATEDUSEAST, ISOLATEDUSEASTB, ISOLATEDUSEASTF, ISOLATEDUSSOUTHF, ISOLATEDUSWEST, and ISOLATEDEUWEST.

AWSCredentialsFile

The path to the AWS Credentials File to be used for authentication.

Data Type

string

Default Value

""

Remarks

The path to the AWS Credentials File to be used for authentication. See https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html for more information.

AWSCredentialsFileProfile

The name of the profile to be used from the supplied AWSCredentialsFile.

Data Type

string

Default Value

default

Remarks

The name of the profile to be used from the supplied AWSCredentialsFile. See https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html for more information.

AWSSessionToken

Your AWS session token.

Data Type

string

Default Value

""

Remarks

Your AWS session token. This value can be retrieved in different ways. See this link for more info.

AWSExternalId

A unique identifier that might be required when you assume a role in another account.

Data Type

string

Default Value

""

Remarks

A unique identifier that might be required when you assume a role in another account.

MFASerialNumber

The serial number of the MFA device if one is being used.

Data Type

string

Default Value

""

Remarks

You can find the device for an IAM user by going to the AWS Management Console and viewing the user's security credentials. For virtual devices, this is actually an Amazon Resource Name (such as arn:aws:iam:123456789012:mfa/user).

MFAToken

The temporary token available from your MFA device.

Data Type

string

Default Value

""

Remarks

If MFA is required, this value will be used along with the MFASerialNumber to retrieve temporary credentials to login. The temporary credentials available from AWS will only last up to 1 hour by default (see TemporaryTokenDuration). Once the time is up, the connection must be updated to specify a new MFA token so that new credentials may be obtained.

TemporaryTokenDuration

The amount of time (in seconds) a temporary token will last.

Data Type

string

Default Value

3600

Remarks

Temporary tokens are used with both MFA and Role based authentication. Temporary tokens will eventually time out, at which time a new temporary token must be obtained. For situations where MFA is not used, this is not a big deal. The Amazon Athena connector will internally request a new temporary token once the temporary token has expired.

However, for MFA required connection, a new MFAToken must be specified in the connection to retrieve a new temporary token. This is a more intrusive issue since it requires an update to the connection by the user. The maximum and minimum that can be specified will depend largely on the connection being used.

For Role based authentication, the minimum duration is 900 seconds (15 minutes) while the maximum if 3600 (1 hour). Even if MFA is used with role based authentication, 3600 is still the maximum.

For MFA authentication by itself (using an IAM User or root user), the minimum is 900 seconds (15 minutes), the maximum is 129600 (36 hours).

AWSCognitoRegion

The hosting region for AWS Cognito.

Possible Values

OHIO, NORTHERNVIRGINIA, NORTHERNCALIFORNIA, OREGON, CAPETOWN, HONGKONG, HYDERABAD, JAKARTA, MALAYSIA, MELBOURNE, MUMBAI, OSAKA, SEOUL, SINGAPORE, SYDNEY, THAILAND, TOKYO, CENTRAL, CALGARY, BEIJING, NINGXIA, FRANKFURT, IRELAND, LONDON, MILAN, PARIS, SPAIN, STOCKHOLM, ZURICH, TELAVIV, MEXICOCENTRAL, BAHRAIN, UAE, SAOPAULO, GOVCLOUDEAST, GOVCLOUDWEST, ISOLATEDUSEAST, ISOLATEDUSEASTB, ISOLATEDUSEASTF, ISOLATEDUSSOUTHF, ISOLATEDUSWEST, ISOLATEDEUWEST

Data Type

string

Default Value

NORTHERNVIRGINIA

Remarks

The hosting region for AWS Cognito. Available values are OHIO, NORTHERNVIRGINIA, NORTHERNCALIFORNIA, OREGON, CAPETOWN, HONGKONG, HYDERABAD, JAKARTA, MALAYSIA, MELBOURNE, MUMBAI, OSAKA, SEOUL, SINGAPORE, SYDNEY, THAILAND, TOKYO, CENTRAL, CALGARY, BEIJING, NINGXIA, FRANKFURT, IRELAND, LONDON, MILAN, PARIS, SPAIN, STOCKHOLM, ZURICH, TELAVIV, MEXICOCENTRAL, BAHRAIN, UAE, SAOPAULO, GOVCLOUDEAST, GOVCLOUDWEST, ISOLATEDUSEAST, ISOLATEDUSEASTB, ISOLATEDUSEASTF, ISOLATEDUSSOUTHF, ISOLATEDUSWEST, and ISOLATEDEUWEST.

AWSUserPoolId

The User Pool Id.

Data Type

string

Default Value

""

Remarks

You can find this in AWS Cognito -> Manage User Pools -> select your user pool -> General settings -> Pool Id.

AWSUserPoolClientAppId

The User Pool Client App Id.

Data Type

string

Default Value

""

Remarks

You can find this in AWS Cognito -> Manage Identity Pools -> select your user pool -> General settings -> App clients -> App client Id.

AWSUserPoolClientAppSecret

Optional. The User Pool Client App Secret.

Data Type

string

Default Value

""

Remarks

You can find this in AWS Cognito -> Manage Identity Pools -> select your user pool -> General settings -> App clients -> App client secret.

AWSIdentityPoolId

The Identity Pool Id.

Data Type

string

Default Value

""

Remarks

You can find this in AWS Cognito -> Manage Identity Pools -> select your identity pool -> Edit identity pool -> Identity Pool Id

AWSWebIdentityToken

The OAuth 2.0 access token or OpenID Connect ID token that is provided by an identity provider.

Data Type

string

Default Value

""

Remarks

The OAuth 2.0 access token or OpenID Connect ID token that is provided by an identity provider. An application can get this token by authenticating a user with a web identity provider. If not specified, the value for this connection property is automatically obtained from the value of the 'AWS_WEB_IDENTITY_TOKEN_FILE' environment variable.

SSO

This section provides a complete list of SSO properties you can configure.

User

The IDP user used to authenticate the IDP via SSO.

Data Type

string

Default Value

""

Remarks

Together with Password, this field is used to authenticate in SSO connections against the Amazon Athena server.

Password

The password used to authenticate the IDP user via SSO.

Data Type

string

Default Value

""

Remarks

The User and Password are together used in SSO connections to authenticate with the server.

SSOLoginURL

The identity provider's login URL.

Data Type

string

Default Value

""

Remarks

The identity provider's login URL.

SSOProperties

Additional properties required to connect to the identity provider in a semicolon-separated list.

Data Type

string

Default Value

""

Remarks

Additional properties required to connect to the identity provider in a semicolon-separated list. SSOProperties is used in conjunction with the the AWSRoleARN and AWSPrincipalARN. The following section provides an example using the OKTA identity provider.

ADFS

To connect to ADFS, set these properties:

• AuthScheme: ADFS.
• User: The authenticating ADFS user.
• Password: The password of the authenticating ADFS user.
• SSOLoginURL: The SSO provider's login URL.

Example connection string:

AuthScheme=ADFS; AWSRegion=Ireland; Database=sampledb; User=user@cdata.com; Password=CH8WerW121235647iCa6; SSOLoginURL='https://adfs.domain.com'; AWSRoleArn=arn:aws:iam:1234:role/ADFS_SSO; AWSPrincipalArn=arn:aws:iam:1234:saml-provider/ADFSProvider; S3StagingDirectory=s3://athena/staging;

Okta

To connect to Okta, set these properties:

• AuthScheme: Okta.
• User: The authentiating Okta user.
• Password: The password of the authenticating Okta user.
• SSOLoginURL: The SSO provider's login URL.

If you are either using a trusted application or proxy that overrides the Okta client request OR configuring MFA, you must use combinations of SSOProperties to authenticate using Okta. Set any of the following, as applicable:

• APIToken: When authenticating a user via a trusted application or proxy that overrides the Okta client request context, set this to the API Token the customer created from the Okta organization.

• MFAType: If you have configured the MFA flow, set this to one of the following supported types: OktaVerify, Email, or SMS.

• MFAPassCode: If you have configured the MFA flow, set this to a valid passcode.

  If you set this to empty or an invalid value, the connector issues a one-time password challenge to your device or email. After the passcode is received, reopen the connection where the retrieved one-time password value is set to the MFAPassCode connection property.

• MFARememberDevice: True by default. Okta supports remembering devices when MFA is required. If remembering devices is allowed according to the configured authentication policies, the connector sends a device token to extend MFA authentication lifetime. If you do not want MFA to be remembered, set this variable to False.

Example connection string:

AuthScheme=Okta; AWSRegion=Ireland; Database=sampledb; User=user@cdata.com; Password=CH8WerW121235647iCa6; SSOLoginURL='https://cdata-us.okta.com/home/amazon_aws/0oa35m8arsAL5f5NrE6NdA356/272'; SSOProperties='ApiToken=01230GGG2ceAnm_tPAf4MhiMELXZ0L0N1pAYrO1VR-hGQSf;'; AWSRoleArn=arn:aws:iam:1234:role/Okta_SSO; AWSPrincipalARN=arn:aws:iam:1234:saml-provider/OktaProvider; S3StagingDirectory=s3://athena/staging;

SSOExchangeURL

The URL used for consuming the SAML response and exchanging it for service specific credentials.

Data Type

string

Default Value

""

Remarks

The Amazon Athena connector will use the URL specified here to consume a SAML response and exchange it for service specific credentials. The retrieved credentials are the final piece during the SSO connection that are used to communicate with Amazon Athena.

OAuth

This section provides a complete list of OAuth properties you can configure.

InitiateOAuth

Specifies the process for obtaining or refreshing the OAuth access token, which maintains user access while an authenticated, authorized user is working.

Possible Values

OFF, REFRESH, GETANDREFRESH

Data Type

string

Default Value

OFF

Remarks

OAuth is an authorization framework that enables applications to obtain limited access to user accounts on an HTTP service. The OAuth flow defines the method to be used for logging in users, exchanging their credentials for an OAuth access token to be used for authentication, and providing limited access to applications.

Amazon Athena supports the following options for initiating OAuth access:

1. OFF: No automatic OAuth flow initiation. The OAuth flow is handled entirely by the user, who will take action to obtain their OAuthAccessToken. Note that with this setting the user must refresh the token manually and reconnect with an updated OAuthAccessToken property when the current token expires.
2. GETANDREFRESH: The OAuth flow is handled entirely by the connector. If a token already exists, it is refreshed when necessary. If no token currently exists, it will be obtained by prompting the user to login.
3. REFRESH: The user handles obtaining the OAuth Access Token and sets up the sequence for refreshing the OAuth Access Token. (The user is never prompted to log in to authenticate. After the user logs in, the connector handles the refresh of the OAuth Access Token.

OAuthClientId

Specifies the client ID (also known as the consumer key) assigned to your custom OAuth application. This ID is required to identify the application to the OAuth authorization server during authentication.

Data Type

string

Default Value

""

Remarks

This property is required when using a custom OAuth application, such as in web-based authentication flows, service-based authentication, or certificate-based flows that require application registration. It is also required if an embedded OAuth application is not available for the driver. When an embedded OAuth application is available, this value may already be provided by the connector and not require manual entry.

This value is generally used alongside other OAuth-related properties such as OAuthClientSecret and OAuthSettingsLocation when configuring an authenticated connection.

OAuthClientId is one of the key connection parameters that need to be set before users can authenticate via OAuth. You can typically find this value in your identity provider’s application registration settings. Look for a field labeled Client ID, Application ID, or Consumer Key.

While the client ID is not considered a confidential value like a client secret, it is still part of your application's identity and should be handled carefully. Avoid exposing it in public repositories or shared configuration files.

OAuthClientSecret

Specifies the client secret assigned to your custom OAuth application. This confidential value is used to authenticate the application to the OAuth authorization server.

Data Type

string

Default Value

""

Remarks

This property is required when using a custom OAuth application in any flow that requires secure client authentication, such as web-based OAuth, service-based connections, or certificate-based authorization flows. It is not required when using an embedded OAuth application.

The client secret is used during the token exchange step of the OAuth flow, when the driver requests an access token from the authorization server. If this value is missing or incorrect, authentication will fail, and the server may return an invalid_client or unauthorized_client error.

OAuthClientSecret is one of the key connection parameters that need to be set before users can authenticate via OAuth. You can obtain this value from your identity provider when registering the OAuth application. It may be referred to as the client secret, application secret, or consumer secret.

This value should be stored securely and never exposed in public repositories, scripts, or unsecured environments. Client secrets may also expire after a set period. Be sure to monitor expiration dates and rotate secrets as needed to maintain uninterrupted access.

OAuthAccessToken

Specifies the OAuth access token used to authenticate requests to the data source. This token is issued by the authorization server after a successful OAuth exchange.

Data Type

string

Default Value

""

Remarks

The OAuthAccessToken is a temporary credential that authorizes access to protected resources. It is typically returned by the identity provider after the user or client application completes an OAuth authentication flow. This property is most commonly used in automated workflows or custom OAuth implementations where you want to manage token handling outside of the driver.

The OAuth access token has a server-dependent timeout, limiting user access. This is set using the OAuthExpiresIn property. However, it can be reissued between requests to keep access alive as long as the user keeps working.

If InitiateOAuth is set to REFRESH, we recommend that you also set both OAuthExpiresIn and OAuthTokenTimestamp. The connector uses these properties to determine when the token expires so it can refresh most efficiently. If OAuthExpiresIn and OAuthTokenTimestamp are not specified, the connector refreshes the token immediately.

Access tokens should be treated as sensitive credentials and stored securely. Avoid exposing them in logs, scripts, or configuration files that are not access-controlled.

OAuthSettingsLocation

The location of the settings file where OAuth values are saved when InitiateOAuth is set to GETANDREFRESH or REFRESH. Alternatively, you can hold this location in memory by specifying a value starting with 'memory://'.

Data Type

string

Default Value

%APPDATA%\\CData\\Acumatica Data Provider\\OAuthSettings.txt

Remarks

When InitiateOAuth is set to GETANDREFRESH or REFRESH, the driver saves OAuth values to avoid requiring the user to manually enter OAuth connection properties and to allow the credentials to be shared across connections or processes.

Instead of specifying a file path, you can use memory storage. Memory locations are specified by using a value starting with 'memory://' followed by a unique identifier for that set of credentials (for example, memory://user1). The identifier can be anything you choose but should be unique to the user. Unlike file-based storage, where credentials persist across connections, memory storage loads the credentials into static memory, and the credentials are shared between connections using the same identifier for the life of the process. To persist credentials outside the current process, you must manually store the credentials prior to closing the connection. This enables you to set them in the connection when the process is started again. You can retrieve OAuth property values with a query to the sys_connection_props system table. If there are multiple connections using the same credentials, the properties are read from the previously closed connection.

The default location is "%APPDATA%\\CData\\Acumatica Data Provider\\OAuthSettings.txt" with %APPDATA% set to the user's configuration directory. The default values are

• Windows: "register://%DSN"
• Unix: "%AppData%..."

where DSN is the name of the current DSN used in the open connection.

The following table lists the value of %APPDATA% by OS:

CallbackURL

Identifies the URL users return to after authenticating to Amazon Athena via OAuth. (Custom OAuth applications only.).

Data Type

string

Default Value

""

Remarks

If you created a custom OAuth application, the OAuth authorization server redirects the user to this URL during the authentication process. This value must match the callback URL you specified when you Configured the custom OAuth application.

OAuthVerifier

Specifies a verifier code returned from the OAuthAuthorizationURL . Used when authenticating to OAuth on a headless server, where a browser can't be launched. Requires both OAuthSettingsLocation and OAuthVerifier to be set.

Data Type

string

Default Value

""

OAuthRefreshToken

Specifies the OAuth refresh token used to request a new access token after the original has expired.

Data Type

string

Default Value

""

Remarks

The refresh token is used to obtain a new access token when the current one expires. It enables seamless authentication for long-running or automated workflows without requiring the user to log in again. This property is especially important in headless, CI/CD, or server-based environments where interactive authentication is not possible.

The refresh token is typically obtained during the initial OAuth exchange by calling the GetOAuthAccessToken stored procedure. After that, it can be set using this property to enable automatic token refresh, or passed to the RefreshOAuthAccessToken stored procedure if you prefer to manage the refresh manually.

When InitiateOAuth is set to REFRESH, the driver uses this token to retrieve a new access token automatically. After the first refresh, the driver saves updated tokens in the location defined by OAuthSettingsLocation, and uses those values for subsequent connections.

The OAuthRefreshToken should be handled securely and stored in a trusted location. Like access tokens, refresh tokens can expire or be revoked depending on the identity provider’s policies.

OAuthExpiresIn

Specifies the duration in seconds, of an OAuth Access Token's lifetime. The token can be reissued to keep access alive as long as the user keeps working.

Data Type

string

Default Value

""

Remarks

The OAuth Access Token is assigned to an authenticated user, granting that user access to the network for a specified period of time. The access token is used in place of the user's login ID and password, which stay on the server.

An access token created by the server is only valid for a limited time. OAuthExpiresIn is the number of seconds the token is valid from when it was created. For example, a token generated at 2024-01-29 20:00:00 UTC that expires at 2024-01-29 21:00:00 UTC (an hour later) would have an OAuthExpiresIn value of 3600, no matter what the current time is.

To determine how long the user has before the Access Token will expire, use OAuthTokenTimestamp.

OAuthTokenTimestamp

Displays a Unix epoch timestamp in milliseconds that shows how long ago the current Access Token was created.

Data Type

string

Default Value

""

Remarks

The OAuth Access Token is assigned to an authenticated user, granting that user access to the network for a specified period of time. The access token is used in place of the user's login ID and password, which stay on the server.

An access token created by the server is only valid for a limited time. OAuthTokenTimestamp is the Unix timestamp when the server created the token. For example, OAuthTokenTimestamp=1706558400 indicates the OAuthAccessToken was generated by the server at 2024-01-29 20:00:00 UTC.

SSL

This section provides a complete list of SSL properties you can configure.

SSLServerCert

Specifies the certificate to be accepted from the server when connecting using TLS/SSL.

Data Type

string

Default Value

""

Remarks

If using a TLS/SSL connection, this property can be used to specify the TLS/SSL certificate to be accepted from the server. Any other certificate that is not trusted by the machine is rejected.

This property can take the following forms:

If not specified, any certificate trusted by the machine is accepted.

Certificates are validated as trusted by the machine based on the System's trust store. The trust store used is the 'javax.net.ssl.trustStore' value specified for the system. If no value is specified for this property, Java's default trust store is used (for example, JAVA_HOME\lib\security\cacerts).

Use '*' to signify to accept all certificates. Note that this is not recommended due to security concerns.

Schema

This section provides a complete list of schema properties you can configure.

Location

Specifies the location of a directory containing schema files that define tables, views, and stored procedures. Depending on your service's requirements, this may be expressed as either an absolute path or a relative path.

Data Type

string

Default Value

%APPDATA%\AmazonAthena Data Provider\Schema

Remarks

The Location property is only needed if you want to either customize definitions (for example, change a column name, ignore a column, etc.) or extend the data model with new tables, views, or stored procedures.

If left unspecified, the default location is %APPDATA%\AmazonAthena Data Provider\Schema, where %APPDATA% is set to the user's configuration directory:

BrowsableSchemas

Optional setting that restricts the schemas reported to a subset of all available schemas. For example, BrowsableSchemas=SchemaA,SchemaB,SchemaC.

Data Type

string

Default Value

""

Remarks

Listing all available database schemas can take extra time, thus degrading performance. Providing a list of schemas in the connection string saves time and improves performance.

Tables

Optional setting that restricts the tables reported to a subset of all available tables. For example, Tables=TableA,TableB,TableC.

Data Type

string

Default Value

""

Remarks

Listing all available tables from some databases can take extra time, thus degrading performance. Providing a list of tables in the connection string saves time and improves performance.

If there are lots of tables available and you already know which ones you want to work with, you can use this property to restrict your viewing to only those tables. To do this, specify the tables you want in a comma-separated list. Each table should be a valid SQL identifier with any special characters escaped using square brackets, double-quotes or backticks. For example, Tables=TableA,[TableB/WithSlash],WithCatalog.WithSchema.`TableC With Space`.

Views

Optional setting that restricts the views reported to a subset of the available tables. For example, Views=ViewA,ViewB,ViewC.

Data Type

string

Default Value

""

Remarks

Listing all available views from some databases can take extra time, thus degrading performance. Providing a list of views in the connection string saves time and improves performance.

If there are lots of views available and you already know which ones you want to work with, you can use this property to restrict your viewing to only those views. To do this, specify the views you want in a comma-separated list. Each view should be a valid SQL identifier with any special characters escaped using square brackets, double-quotes or backticks. For example, Views=ViewA,[ViewB/WithSlash],WithCatalog.WithSchema.`ViewC With Space`.

FlattenArrays

By default, arrays are returned as strings of JSON. The FlattenArrays property can be used to flatten the elements of arrays into columns of their own. Set FlattenArrays to the number of elements you want to return from arrays.

Data Type

int

Default Value

0

Remarks

By default, arrays are returned as strings of JSON. The FlattenArrays property can be used to flatten the elements of arrays into columns of their own. This is only recommended for arrays that are expected to be short.

Set FlattenArrays to the number of elements you want to return from arrays. The specified elements are returned as columns. The zero-based index is concatenated to the column name. Other elements are ignored.

For example, you can return an arbitrary number of elements from an array of strings:

["FLOW-MATIC","LISP","COBOL"]

When FlattenArrays is set to 1, the preceding array is flattened into the following table:

Setting FlattenArrays to -1 will flatten all the elements of arrays.

FlattenObjects

Set FlattenObjects to true to flatten object properties into columns of their own. Otherwise, objects nested in arrays are returned as strings of JSON.

Data Type

bool

Default Value

false

Remarks

Set FlattenObjects to true to flatten object properties into columns of their own. Otherwise, objects nested in arrays are returned as strings of JSON. To generate the column name, the connector concatenates the property name onto the object name with a dot.

For example, you can flatten the nested objects below at connection time:

[
     { "grade": "A", "score": 2 },
     { "grade": "A", "score": 6 },
     { "grade": "A", "score": 10 },
     { "grade": "A", "score": 9 },
     { "grade": "B", "score": 14 }
]

When FlattenObjects is set to true and FlattenArrays is set to 1, the preceding array is flattened into the following table:

Miscellaneous

This section provides a complete list of miscellaneous properties you can configure.

CleanQueryResults

Amazon Athena produces cache files with every query, in the folder specified in S3StagingDirectory . CleanQueryResults specifies whether these files should be deleted once the connection is closed.

Data Type

bool

Default Value

true

Remarks

Amazon Athena stores the results of every query you execute as a CSV file in S3StagingDirectory. These CSV files can quickly rack up a lot of space in Amazon S3.

You can use CleanQueryResults, enabled by default, to clean these files for every query executed. Note that this behavior will add a minor performance hit when you disconnect the last connection in a process.

See Also

See Fine-Tuning Data Access for more information on configuring Athena's query caching.

EnableFIPSMode

A boolean indicating if FIPS URLs should be enabled.

Data Type

bool

Default Value

false

Remarks

FIPS or Federal Information Processing Standard are seperate endpoints in Amazon that may be required for certain government organizations. Set EnableFIPSMode to true to switch to using these endpoints. See more information here: https://aws.amazon.com/compliance/fips/.

IncludeTableTypes

If set to true, the provider will query for the types of individual tables.

Data Type

bool

Default Value

false

Remarks

If set to true, the connector will either query Athena or Glue for the types of individual tables. MetadataDiscoveryMethod toggles the service which will be used to retrieve the types.

MaximumColumnSize

The maximum column size.

Data Type

int

Default Value

255

Remarks

Some tools restrain the largest size of a column or the total size of all the columns selected. You can set the MaximumColumnSize to overcome these schema-based restrictions. The connector will not report any column to be larger than the MaximumColumnSize.

Set a MaximumColumnSize of zero to eliminate limits on column size, as shown in the following example:

MaxRows

Specifies the maximum rows returned for queries without aggregation or GROUP BY.

Data Type

int

Default Value

-1

Remarks

This property sets an upper limit on the number of rows the connector returns for queries that do not include aggregation or GROUP BY clauses. This limit ensures that queries do not return excessively large result sets by default.

When a query includes a LIMIT clause, the value specified in the query takes precedence over the MaxRows setting. If MaxRows is set to "-1", no row limit is enforced unless a LIMIT clause is explicitly included in the query.

This property is useful for optimizing performance and preventing excessive resource consumption when executing queries that could otherwise return very large datasets.

MetadataDiscoveryMethod

API to use to retrieve the metadata for Amazon Athena.

Possible Values

Glue, Athena

Data Type

string

Default Value

Athena

Remarks

API to use to retrieve the metadata for Amazon Athena.

Other

Specifies additional hidden properties for specific use cases. These are not required for typical provider functionality. Use a semicolon-separated list to define multiple properties.

Data Type

string

Default Value

""

Remarks

This property allows advanced users to configure hidden properties for specialized scenarios. These settings are not required for normal use cases but can address unique requirements or provide additional functionality. Multiple properties can be defined in a semicolon-separated list.

Specify multiple properties in a semicolon-separated list.

Integration and Formatting

PageSize

The number of results to return per page of data retrieved from Amazon Athena.

Data Type

string

Default Value

""

Remarks

This property determines the number of results to return per page of data retrieved from Amazon Athena. See Fine-Tuning Data Access for more information on settings this property to avoid request throttling. When using ResultFetcher=GetQueryResults, the default and maximum allowed value is 1000.

PollingInterval

This determines the polling interval in milliseconds to check whether the result is ready to be retrieved.

Data Type

string

Default Value

100

Remarks

This property determines how long to wait between checking whether or not the query's results are ready. Very large resultsets or complex queries may take longer to process, and a low polling interval may result in many unnecessary requests being made to check the query status.

PseudoColumns

Specifies the pseudocolumns to expose as table columns. Use the format 'TableName=ColumnName;TableName=ColumnName'. The default is an empty string, which disables this property.

Data Type

string

Default Value

""

Remarks

This property allows you to define which pseudocolumns the connector exposes as table columns.

To specify individual pseudocolumns, use the following format: "Table1=Column1;Table1=Column2;Table2=Column3"

To include all pseudocolumns for all tables use: "*=*"

PushEmptyValuesAsNull

Indicates whether to read the empty values as empty or as null.

Data Type

bool

Default Value

false

Remarks

Indicates whether to read the empty values as empty or as null.

QueryCachingLevel

Modifies the usage of query results stored in S3StagingDirectory . Cached queries will not be scanned again by Amazon Athena until the amount of seconds specified in QueryTolerance has passed.

Possible Values

None, Local, Cloud

Data Type

string

Default Value

Local

Remarks

Modifies the usage of query results stored in S3StagingDirectory. Cached queries will not be scanned again by Amazon Athena until the amount of seconds specified in QueryTolerance has passed. The casing of the queries must match exactly to trigger the behavior, which is explained below:

QueryPassthrough

This option passes the query to the Amazon Athena server as is.

Data Type

bool

Default Value

false

Remarks

When this is set, queries are passed through directly to Amazon Athena.

QueryTimeout

The timeout in seconds for requests issued by the provider to download large result sets.

Data Type

int

Default Value

1800

Remarks

If the QueryTimeout property is set to 0, operations will not time out; instead, they will run until they complete successfully or encounter an error condition. This property is distinct from Timeout which applies to individual HTTP operations while QueryTimeout applies to execution time of the operation as a whole.

If QueryTimeout expires and the request has not finished being processed, the connector raises an error condition.

QueryTolerance

Specifies the amount of time in seconds queries cache for if QueryCachingLevel is not set to None.

Data Type

string

Default Value

600

Remarks

Specifies the amount of time in seconds queries will cache for if QueryCachingLevel is not set to None. Values lower than 1 are not accepted.

ResultFetcher

The fetcher that will be used to download query results.

Possible Values

S3, GetQueryResults, GetQueryResultsStream

Data Type

string

Default Value

S3

Remarks

This property determines how query results are fetched. If set to S3, query results are downloaded directly from Amazon S3. If set to GetQueryResults, query results are fetched utilizing the Athena APIs. If set to GetQueryResultsStream, results are fetched utilizing the Athena Stream API.

ShowS3Filepath

Whether or not to expose the _S3Path column for the Amazon Athena tables.

Data Type

bool

Default Value

false

Remarks

The _S3Path column refers to the Amazon Athena's $path column, which returns the path of the source Amazon S3 file for each row in the output.

The connector will expose the _S3Path column for each table, only if this connection property is set to TRUE.

Timeout

Specifies the maximum time, in seconds, that the provider waits for a server response before throwing a timeout error. The default is 60 seconds. Set to 0 to disable the timeout.

Data Type

int

Default Value

60

Remarks

This property controls the maximum time, in seconds, that the connector waits for an operation to complete before canceling it. If the timeout period expires before the operation finishes, the connector cancels the operation and throws an exception.

The timeout applies to each individual communication with the server rather than the entire query or operation. For example, a query could continue running beyond the timeout value if each paging call completes within the timeout limit.

Setting this property to 0 disables the timeout, allowing operations to run indefinitely until they succeed or fail due to other conditions such as server-side timeouts, network interruptions, or resource limits on the server. Use this property cautiously to avoid long-running operations that could degrade performance or result in unresponsive behavior.

UserDefinedViews

Specifies a filepath to a JSON configuration file defining custom views. The provider automatically detects and uses the views specified in this file.

Data Type

string

Default Value

""

Remarks

This property allows you to define and manage custom views through a JSON-formatted configuration file called UserDefinedViews.json. These views are automatically recognized by the connector and enable you to execute custom SQL queries as if they were standard database views. The JSON file defines each view as a root element with a child element called "query", which contains the SQL query for the view. For example:

{
    "MyView": {
        "query": "SELECT * FROM [AwsDataCatalog].[sampledb].Customers WHERE MyColumn = 'value'"
    },
    "MyView2": {
        "query": "SELECT * FROM MyTable WHERE Id IN (1,2,3)"
    }

}

You can define multiple views in a single file and specify the filepath using this property. For example: UserDefinedViews=C:\Path\To\UserDefinedViews.json. When you use this property, only the specified views are seen by the connector.

Refer to User Defined Views for more information.

Workgroup

Work group of the executed queries.

Data Type

string

Default Value

""

Remarks

Work group of the executed queries.