Restrict user from executing INSERT queries on athena

Question

I want to restrict user from executing INSERT queries in master table(Not CTAS table) in athena. If there way, I can achieve this ? user will executing queries from Lambda.

Answer 1

Athena just supports StartQueryExecution and StopQueryExecution as actions in IAM permission policies - so there is no differentiation which type of SQL Command (DDL, DML) is being executed.

However, I think you can overcome this by denying permissions on glue and S3 so Athena queries that try to execute INSERTs will fail:

• glue permissions can be managed on catalog, database and table level, some examples can be found in AWS' Identity-Based Policies (IAM Policies) for Access Control for Glue
• Relevant glue actions to deny: BatchCreatePartition, CreatePartition, UpdatePartition - see Actions, resources, and condition keys for AWS Glue
• On S3 you need to deny PutObject or Put* for the S3 location of the specific table, see Actions defined by Amazon S3 - again this can be defined on a object level in a bucket.