GrowthLoop connects directly to Amazon Athena so you can build and activate audiences from customer data in Amazon S3. Athena uses the AWS Glue Data Catalog for table metadata, and GrowthLoop stores its snapshot state as Apache Iceberg tables in an S3 location that you control.

Prerequisites

Before connecting Athena, make sure you have:

An AWS account with access to Amazon Athena, AWS Glue, IAM, and Amazon S3.
Customer tables or views registered in an AWS Glue Data Catalog and queryable from Athena.
Permission to create an S3 bucket or dedicated prefixes for Athena query results and GrowthLoop Iceberg tables.
Permission to create an IAM user and access key for GrowthLoop.

Use the same AWS Region for Athena, the Glue Data Catalog, and the S3 bucket. Record the Region name, such as us-east-1, because you will enter it in GrowthLoop.

Set up Amazon S3

Create two dedicated prefixes in an S3 bucket. You can use one bucket for both prefixes:

S3 location	Purpose	Example
Athena query results	Stores the results and metadata generated when Athena runs queries.	`s3://your-bucket/athena-results/`
Iceberg table root	Stores GrowthLoop-managed Iceberg snapshot tables.	`s3://your-bucket/growthloop-iceberg/`

Open the Amazon S3 console.
Click Create bucket.
Enter a bucket name and select the same AWS Region that you will use for Athena.
Keep Block all public access enabled.
Click Create bucket.

You do not need to create empty folders in advance. Save both complete s3:// URIs, including the trailing slash.

Configure an Athena workgroup

Open the Amazon Athena console.
Select the AWS Region that contains your Glue catalog and S3 bucket.
In the left navigation, click Workgroups.
Create a workgroup or select an existing workgroup such as primary.
Configure the workgroup to use Athena engine version 3.
Under Query result configuration, enter your query-results prefix, such as s3://your-bucket/athena-results/.
Save the workgroup and record its name.

GrowthLoop sends the query-results URI with each connection. If your workgroup overrides client-side query-result settings, configure the workgroup with the same accessible S3 location. Learn more in the AWS guide to Athena query-result locations.

Create the snapshot database

GrowthLoop needs a writable Glue database for its Iceberg snapshot tables. flywheel_system is the recommended name.

Open Athena query editor.
Select your workgroup and the AwsDataCatalog data source.
Run the following statement:

CREATE DATABASE IF NOT EXISTS flywheel_system;

GrowthLoop creates and manages the required Iceberg tables inside this database. Athena creates Iceberg v2 tables and stores their data under the Iceberg S3 root that you provide. For more information, review Create Iceberg tables in Athena.

Create an IAM user for GrowthLoop

Create a dedicated IAM user instead of sharing a person's AWS credentials.

Open the AWS IAM console.
In the left navigation, click Users, then click Create user.
Enter a descriptive name such as growthloop-athena and create the user.
Grant the user permission to:
- Run and inspect queries in the selected Athena workgroup.
- List the data catalogs available in the selected Region.
- Read database, table, view, and partition metadata from AWS Glue.
- Read the source-table S3 locations that you want to use in GrowthLoop.
- Create, update, and delete tables in the flywheel_system Glue database.
- Read and write the Athena query-results and GrowthLoop Iceberg S3 prefixes.
Open the user's Security credentials tab.
Under Access keys, click Create access key.
Select Third-party service, acknowledge the recommendation, and create the key.
Securely save the Access key ID and Secret access key. AWS displays the secret only once.

📘
Note
If AWS Lake Formation governs your catalog or S3 locations, grant the IAM user the corresponding Lake Formation permissions as well. IAM permissions alone do not override Lake Formation access controls.

Example IAM policy

Use the following policy as a starting point. Replace the AWS Region, account ID, workgroup, bucket name, source database, source prefixes, and snapshot database with your values. Narrow the resources further when your AWS security standards require it.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RunAthenaQueries",
      "Effect": "Allow",
      "Action": [
        "athena:GetDataCatalog",
        "athena:GetDatabase",
        "athena:GetQueryExecution",
        "athena:GetQueryResults",
        "athena:GetTableMetadata",
        "athena:GetWorkGroup",
        "athena:ListDataCatalogs",
        "athena:ListDatabases",
        "athena:ListTableMetadata",
        "athena:StartQueryExecution",
        "athena:StopQueryExecution"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ReadGlueCatalog",
      "Effect": "Allow",
      "Action": [
        "glue:BatchGetPartition",
        "glue:GetDatabase",
        "glue:GetDatabases",
        "glue:GetPartition",
        "glue:GetPartitions",
        "glue:GetTable",
        "glue:GetTables"
      ],
      "Resource": [
        "arn:aws:glue:AWS_REGION:AWS_ACCOUNT_ID:catalog",
        "arn:aws:glue:AWS_REGION:AWS_ACCOUNT_ID:database/SOURCE_DATABASE",
        "arn:aws:glue:AWS_REGION:AWS_ACCOUNT_ID:table/SOURCE_DATABASE/*",
        "arn:aws:glue:AWS_REGION:AWS_ACCOUNT_ID:database/flywheel_system",
        "arn:aws:glue:AWS_REGION:AWS_ACCOUNT_ID:table/flywheel_system/*"
      ]
    },
    {
      "Sid": "ManageSnapshotGlueTables",
      "Effect": "Allow",
      "Action": [
        "glue:BatchCreatePartition",
        "glue:BatchDeletePartition",
        "glue:CreatePartition",
        "glue:CreateTable",
        "glue:DeletePartition",
        "glue:DeleteTable",
        "glue:UpdatePartition",
        "glue:UpdateTable"
      ],
      "Resource": [
        "arn:aws:glue:AWS_REGION:AWS_ACCOUNT_ID:catalog",
        "arn:aws:glue:AWS_REGION:AWS_ACCOUNT_ID:database/flywheel_system",
        "arn:aws:glue:AWS_REGION:AWS_ACCOUNT_ID:table/flywheel_system/*"
      ]
    },
    {
      "Sid": "ListAthenaBuckets",
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::SOURCE_BUCKET",
        "arn:aws:s3:::YOUR_BUCKET"
      ]
    },
    {
      "Sid": "ReadSourceData",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::SOURCE_BUCKET/SOURCE_PREFIX/*"
    },
    {
      "Sid": "ManageGrowthLoopData",
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:ListMultipartUploadParts",
        "s3:PutObject"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR_BUCKET/athena-results/*",
        "arn:aws:s3:::YOUR_BUCKET/growthloop-iceberg/*"
      ]
    }
  ]
}

⚠️
Warning
If your source data or S3 prefixes use an AWS KMS customer-managed key, also grant the IAM user the required KMS permissions on that key.

Connect Athena in GrowthLoop

Sign in to GrowthLoop.
Select Amazon Athena when you create a Source.
Enter the connection settings:

GrowthLoop field	What to enter
Name	A recognizable name for this Source, such as `Production Athena`.
Description	An optional description of the data available through the Source.
AWS Region	The Region containing your Athena workgroup and Glue catalog, such as `us-east-1`.
Athena query results S3 URI	The complete query-results prefix, such as `s3://your-bucket/athena-results/`.
Athena workgroup	The workgroup that GrowthLoop should use, such as `primary`.
Iceberg table S3 root	The complete writable Iceberg prefix, such as `s3://your-bucket/growthloop-iceberg/`.
AWS Access Key ID	The access key ID for the dedicated IAM user.
AWS Secret Access Key	The secret access key for the dedicated IAM user.
AWS Session Token	Enter a session token only when you are using temporary AWS credentials. Leave it blank for a standard IAM user access key.
Dataset for snapshots	The Glue database GrowthLoop will use for managed Iceberg tables. Use `flywheel_system` unless you created a different database.

Click Check credentials.
Continue when GrowthLoop confirms the connection.

Add an Athena dataset

Select your Athena Source.
Select Table or View as the dataset source type.
Select a dataset. GrowthLoop displays datasets as catalog->database, such as AwsDataCatalog->analytics.
Select a table or view.
Enter a GrowthLoop dataset name and optional description.
Select the unique key and any other fields required by your data model.
Save the dataset.

The connection can discover multiple Athena data catalogs that the IAM user can access. You select the catalog and Glue database for each GrowthLoop dataset instead of locking the entire Source to one catalog.

Verify the setup

Confirm the following before building your first audience:

Check credentials succeeds in GrowthLoop.
Your Glue databases appear in the dataset selector.
Your Athena tables and views appear after you select a dataset.
A simple query runs successfully in Athena with the GrowthLoop IAM user's permissions.
GrowthLoop can create Iceberg tables under the configured snapshot database and S3 root.

Congratulations! Your Athena Source is ready for building audiences in GrowthLoop.

📘
Note
Experiencing any issues? Reach out to us at [email protected] and we'll help resolve the matter.

Prerequisites

Set up Amazon S3

Configure an Athena workgroup

Create the snapshot database

Create an IAM user for GrowthLoop

Note

Example IAM policy

Warning

Connect Athena in GrowthLoop

Add an Athena dataset

Verify the setup

Note

What’s Next