I am trying to query athena by assuming a role by using Cognito_IdedtityPool to get temporary accessKey, secretKey and sessionToken which has full Athena and S3 permission. But when i call it from my .js file it throws error User:
Error : arn:aws:sts::<acc_no>:assumed-role/... is not authorized to perform: athena:StartQueryExecution on resource: arn:aws:athena:us-east-1:... because no session policy allows the athena:StartQueryExecution action
But once I create an IAM User and hardcode the keys with full Athena and S3 permission. then i am able to get data. Can anyone help in this ?
How can i query using assumed role ?
My js code is below :
AWS.config.credentials = new AWS.CognitoIdentityCredentials({
IdentityPoolId: 'us-east-1:<pool-id>',
});
var config = {
accessKey: credentials.accessKeyId, // REQUIRED
secretKey: credentials.secretAccessKey, //REQUIRED
sessionToken: credentials.sessionToken,// REQUIRED
region: 'us-east-1',
apiVersion: '2017-05-18',
}
AWS.config.update(config);
const AthenaExpress = require("athena-express"),
const athenaExpressConfig = {
aws: AWS,
s3: "s3://athena-output-destination/Test",
getStats: true,
workgroup: 'primary',
catalog: ATHENA_CATALOG,
retry: 4,
formatJson: true,
};
const athenaExpress = new AthenaExpress(athenaExpressConfig);
(async () => {
let myQuery = {
sql: query_string,
db: ATHENA_DB
};
try {
let results = await athenaExpress.query(myQuery);
console.log(results);
} catch (error) {
console.log(error);
}
})();