Skip to content

Commit 3fc7235

Browse files
authored
docs: add IAM role authentication for Athena warehouse connections (#402)
1 parent d7371dd commit 3fc7235

2 files changed

Lines changed: 11 additions & 1 deletion

File tree

get-started/setup-lightdash/connect-project.mdx

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -739,7 +739,11 @@ Your AWS access key ID for authentication. This should belong to an IAM user wit
739739
Your AWS secret access key for authentication.
740740

741741
<Info>
742-
We recommend creating a dedicated IAM user for Lightdash with minimal permissions:
742+
Self-hosted instances can use IAM role authentication (e.g. ECS task role, EC2 instance profile) instead of access keys. See the [`ATHENA_WAREHOUSE_IAM_ROLE_AUTH`](/self-host/customize-deployment/environment-variables#athena) environment variable.
743+
</Info>
744+
745+
<Info>
746+
We recommend creating a dedicated IAM user or role for Lightdash with minimal permissions:
743747
- `AmazonAthenaFullAccess` (or a more restrictive custom policy)
744748
- S3 read/write access to your staging and data directories
745749
</Info>

self-host/customize-deployment/environment-variables.mdx

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,12 @@ This is a reference to all environment variables that can be used to configure a
5454

5555
Lightdash also accepts all [standard postgres environment variables](https://www.postgresql.org/docs/9.3/libpq-envars.html)
5656

57+
## Athena
58+
59+
| Variable | Description |
60+
| :---------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
61+
| `ATHENA_WAREHOUSE_IAM_ROLE_AUTH` | Set to `true` to enable IAM role authentication for Athena warehouse connections. When enabled, users can choose between Access Keys and IAM Role auth in the connection form. IAM Role auth uses the AWS default credential chain (e.g. ECS task role, EC2 instance profile) instead of explicit access keys. Default: `false`. |
62+
5763
## Snowflake
5864

5965
| Variable | Description |

0 commit comments

Comments
 (0)