> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stigg.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon Athena

## Overview

Stigg's integration with Amazon Athena allows you to export your product catalog, customer, and subscription data to S3 and query it directly with Athena — no database infrastructure to manage.

<Note>
  Stigg's native data export integrations are included in the Scale plan, and are also available as an optional add-on to the Growth plan. See Stigg's pricing for more details.
</Note>

<Card title="View the full entity schema" icon="sitemap" href="./schema">
  See every table and column exported to your destination, organized by entity group.
</Card>

## Setting up the integration

### Prerequisites

* An S3 bucket in your AWS account for staging exported data
* An Athena workgroup (defaults to `primary` if you don't use a dedicated one)
* An IAM role (recommended) or IAM user that Stigg can use to write to S3, run Athena queries, and manage Glue Data Catalog tables

<Steps>
  <Step title="Create the S3 staging bucket">
    In the [S3 console](https://console.aws.amazon.com/s3/), create a bucket for Stigg to write data to. AWS recommends disabling ACLs and blocking all public access on the bucket.
  </Step>

  <Step title="Create the IAM access policy">
    Create an IAM policy granting the permissions Stigg needs, replacing `ACCOUNT_ID`, `WORKGROUP`, `BUCKET_NAME`, and `SCHEMA` with your own values:

    <CodeGroup>
      ```json policy.json theme={null}
      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Sid": "AllowAthenaAccess",
                  "Effect": "Allow",
                  "Action": [
                      "athena:GetQueryResults",
                      "athena:StartQueryExecution",
                      "athena:StopQueryExecution",
                      "athena:StartSession",
                      "athena:GetDatabase",
                      "athena:GetDataCatalog",
                      "athena:GetWorkGroup",
                      "athena:GetTableMetadata",
                      "athena:GetQueryExecution"
                  ],
                  "Resource": ["arn:aws:athena:*:ACCOUNT_ID:workgroup/WORKGROUP"]
              },
              {
                  "Sid": "AllowGlueAccessToDestinationDatabaseAndTables",
                  "Effect": "Allow",
                  "Action": [
                      "glue:GetDatabases",
                      "glue:GetDatabase",
                      "glue:GetTables",
                      "glue:GetTable",
                      "glue:GetPartitions",
                      "glue:CreateTable",
                      "glue:CreateDatabase",
                      "glue:UpdateTable",
                      "glue:DeleteTable"
                  ],
                  "Resource": [
                      "arn:aws:glue:*:ACCOUNT_ID:catalog",
                      "arn:aws:glue:*:ACCOUNT_ID:database/SCHEMA",
                      "arn:aws:glue:*:ACCOUNT_ID:database/default",
                      "arn:aws:glue:*:ACCOUNT_ID:table/SCHEMA/*"
                  ]
              },
              {
                  "Sid": "AllowS3AccessToBucket",
                  "Effect": "Allow",
                  "Action": [
                      "s3:PutObject",
                      "s3:ListBucket",
                      "s3:GetBucketLocation",
                      "s3:GetObject",
                      "s3:DeleteObject"
                  ],
                  "Resource": [
                      "arn:aws:s3:::BUCKET_NAME",
                      "arn:aws:s3:::BUCKET_NAME/*"
                  ]
              }
          ]
      }
      ```
    </CodeGroup>

    <Note>
      If the bucket uses a customer-managed KMS key, also add a statement granting `kms:GenerateDataKey` and `kms:Decrypt` on `arn:aws:kms:REGION_NAME:ACCOUNT_ID:key/KEY_ID`. Encryption with SSE-C isn't currently supported.
    </Note>
  </Step>

  <Step title="Create the IAM role">
    In the [AWS IAM console](https://console.aws.amazon.com/iam/), create a role using **Custom trust policy**. The Stigg connect form shows a trust policy prepopulated with the identifiers for your account — paste it in as-is:

    <CodeGroup>
      ```json trust-policy.json theme={null}
      {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": ["sts:AssumeRoleWithWebIdentity"],
            "Principal": {"Federated": "accounts.google.com"},
            "Condition": {
              "StringEquals": {
                "accounts.google.com:oaud": "<organization_identifier>",
                "accounts.google.com:sub": "<service_account_identifier>"
              }
            }
          }
        ]
      }
      ```
    </CodeGroup>

    Attach the access policy from the previous step, name the role something recognizable (e.g. `transfer-role`), and record its ARN.

    <Note>
      If your organization's policy rules out cross-account role assumption, you can instead create an IAM user with programmatic access, attach the same access policy, and use its Access Key ID and Secret Access Key when connecting below.
    </Note>
  </Step>

  <Step title="Connect Stigg with Athena">
    In [Stigg](https://app.stigg.io/), navigate to **Integrations > Apps > Amazon Athena**.

    Enter the following information in the connection form:

    | Field         | Description                                                                                                                |
    | ------------- | -------------------------------------------------------------------------------------------------------------------------- |
    | Database      | The Glue/Athena database where tables will be registered. Created automatically on first sync if it doesn't already exist. |
    | Schema        | The schema name for your Stigg data                                                                                        |
    | Workgroup     | The Athena workgroup to use. Defaults to `primary`.                                                                        |
    | Bucket name   | The S3 staging bucket created above                                                                                        |
    | Bucket region | The AWS region of your S3 bucket                                                                                           |
    | IAM Role ARN  | The ARN of the IAM role created above (or Access Key ID / Secret Access Key if using an IAM user)                          |

    Click **Test & connect**.
  </Step>

  <Step title="Select entities to export">
    After entering your connection details, expand the **Entities to export** section to choose which entity groups to include in the sync. All groups are selected by default.

    See [Exported entities](./overview#exported-entities) for a description of each group.
  </Step>
</Steps>

## Working with Iceberg tables

Athena stores exported tables in Apache Iceberg format. A few operations are useful to know about:

<CodeGroup>
  ```sql optimize.sql theme={null}
  OPTIMIZE iceberg_table REWRITE DATA;
  ```

  ```sql vacuum.sql theme={null}
  ALTER TABLE iceberg_table SET TBLPROPERTIES (
    'vacuum_max_snapshot_age_seconds'='259200');
  ```

  ```sql time-travel.sql theme={null}
  SELECT * FROM iceberg_table FOR TIMESTAMP AS OF timestamp;
  ```
</CodeGroup>

The default snapshot retention is `432000` seconds (5 days) — the example above shortens it to 3 days. Only adjust this if query performance degrades.


## Related topics

- [Exported entities](/documentation/importing-and-exporting-data/export/overview.md#exported-entities)
- [Sync process, schedule, manual sync, and sync history](/documentation/importing-and-exporting-data/export/overview.md#sync-process)