# Connect Athena to Row Zero

Row Zero makes it easy to connect Amazon Athena to your spreadsheets with our built-in Athena connector. Follow the instructions below to connect to Athena, share your connection with others, and import data to a spreadsheet.

## Create your Athena connection

Follow the instructions below to connect to Amazon Athena.

### Step 1: Create an AWS bucket for Athena to write results which Row Zero will read.

You need to create a bucket in the same account and region that your Athena is running in. We recommend a name like **s3://YOURCOMPANY-ROWZERO-ATHENA-RESULTS/**.

![create aws bucket for athena](https://cdn.sanity.io/images/2w8agf2t/production/7c6e540f814fdf2babc2df5058f3bd8b426407f0-548x818.png)

Only temporary data goes into this bucket, so we recommend creating a lifecycle policy to delete all data from this bucket after 1 day.

![create bucket lifecycle rule](https://cdn.sanity.io/images/2w8agf2t/production/f1f5dc7b9cb7d08cdc58b7ed44c0ee3ba6701e40-835x848.png)

![bucket deletion](https://cdn.sanity.io/images/2w8agf2t/production/825ee30fa343d3eea1525457d628b0e280f6ea60-816x422.png)

### Step 2: Create an AWS role that can execute queries against Athena tables (and write results to the bucket above).

Create a role that Row Zero will use to execute Athena queries on your behalf and read the results. The role must have a trust policy that allows the Row Zero account (732940336628) to use the role, using the connection-specific External ID that is provided when you go to create an Athena connection ([see Step 3 below](#step-3-create-the-connection-in-row-zero-that-will-use-the-role-created-above)).

![aws role trust relationship](https://cdn.sanity.io/images/2w8agf2t/production/9795dedcc1b4889d50f32ac9817c588d4d2817cf-1035x523.png)

This role must have permissions to use Athena and permissions to read the results. You can choose to use predefined permissions to Athena/S3 or attach inline policies.

Here's an example inline policy for reading results:

```sql
{
   "Version": "2012-10-17",
   "Statement": [{
       "Effect": "Allow",
       "Action": [
           "s3:Get*",
           "s3:List*",
           "s3:Describe*",
           "s3:PutLifecycleConfiguration",
           "s3:PutBucketVersioning"
       ],
       "Resource": [
           "arn:aws:s3:::{YOUR_RZ_ATHENA_RESULT_STAGING_BUCKET}"
       ],
       "Condition": {
           "StringEquals": {
               "aws:ResourceAccount": "{YOUR_AWS_ACCOUNT_ID}"
           }
       }
   },
   {
       "Effect": "Allow",
       "Action": [
           "s3:Get*",
           "s3:List*",
           "s3:Describe*",
           "s3:AbortMultipartUpload",
           "s3:PutObject",
           "s3:DeleteObject"
       ],
       "Resource": [
           "arn:aws:s3:::{YOUR_RZ_ATHENA_RESULT_STAGING_BUCKET}/*"
       ],
       "Condition": {
           "StringEquals": {
               "aws:ResourceAccount": "{YOUR-AWS-ACCOUNT-ID}"
           }
       }
   }]
}
```

Here is a starting point for an Athena access policy, but it needs be updated to ensure it has access to run queries against your datasets. You should narrow the permissions in the example as appropriate.

```sql
{
   "Version": "2012-10-17",
   "Statement": [
       {
           "Sid": "BaseAthenaPermissions",
           "Effect": "Allow",
           "Action": [
               "athena:*"
           ],
           "Resource": [
               "*"
           ],
           "Condition": {
               "StringEquals": {
                   "aws:ResourceAccount": "{YOUR-AWS-ACCOUNT-ID}"
               }
           }
       },
       {
           "Sid": "BaseGluePermissions",
           "Effect": "Allow",
           "Action": [
               "glue:GetCatalog",
               "glue:GetCatalogs",
               "glue:GetDatabase",
               "glue:GetDatabases",
               "glue:GetTable",
               "glue:GetTables",
               "glue:GetPartition",
               "glue:GetPartitions",
               "glue:BatchGetPartition",
               "glue:StartColumnStatisticsTaskRun",
               "glue:GetColumnStatisticsTaskRun",
               "glue:GetColumnStatisticsTaskRuns",
               "glue:GetCatalogImportStatus"
           ],
           "Resource": [
               "*"
           ]
       }
   ]
}
```

### Step 3. Create the connection in Row Zero that will use the role created above.

From your Row Zero homepage, click **+ New** in the upper left corner and then choose **Connection**.  

![create new connection in Row Zero](https://cdn.sanity.io/images/2w8agf2t/production/3e17b739a700d529447c921c985bd651f6096a3d-512x920.png)

Select Athena as your connection type and fill in the connection details corresponding to the steps above. Note that the External ID you see here is what you should use in [Step 2 above](#step-2-create-an-aws-role-that-can-execute-queries-against-athena-tables-and-write-results-to-the-bucket-above).

![athena connector in spreadsheet](https://cdn.sanity.io/images/2w8agf2t/production/a3091392679997c6271399d921b4010b5922f74a-522x681.png)

Once all the information is entered, click 'Test connection' to ensure the information is correct. If the test returns green, you're good to go and can click 'Create connection.'

### Step 4: If needed, share your connection

If you would like other users to be able to use this role to query Athena from Row Zero, you can securely share the connection with them in Row Zero. This is appropriate if multiple users share a service account. To share your connection in Row Zero:

1. Navigate to your [Connections](/connections) page.
2. Find the Connection that you'd like to share, click '...' next to the name of the connection, and select 'Manage sharing'.
3. Enter the emails of the users or groups that should have access to this connection.

## Write a query to import data from Athena

Now that you have created an Athena connection, you can import data by writing queries directly from Row Zero. See [Data Import](/docs/data-import#custom-queries-using-sql-editor-and-query-builder) to learn how.