From 9f1740056d1ecd2a748d2a9be694e5cd781aee73 Mon Sep 17 00:00:00 2001 From: Giorgi Bagdavadze Date: Thu, 12 Feb 2026 11:50:13 +0400 Subject: [PATCH] docs: add IAM role authentication for Athena warehouse connections --- get-started/setup-lightdash/connect-project.mdx | 6 +++++- self-host/customize-deployment/environment-variables.mdx | 6 ++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/get-started/setup-lightdash/connect-project.mdx b/get-started/setup-lightdash/connect-project.mdx index e53d46ab..e27747f4 100644 --- a/get-started/setup-lightdash/connect-project.mdx +++ b/get-started/setup-lightdash/connect-project.mdx @@ -739,7 +739,11 @@ Your AWS access key ID for authentication. This should belong to an IAM user wit Your AWS secret access key for authentication. - We recommend creating a dedicated IAM user for Lightdash with minimal permissions: + Self-hosted instances can use IAM role authentication (e.g. ECS task role, EC2 instance profile) instead of access keys. See the [`ATHENA_WAREHOUSE_IAM_ROLE_AUTH`](/self-host/customize-deployment/environment-variables#athena) environment variable. + + + + We recommend creating a dedicated IAM user or role for Lightdash with minimal permissions: - `AmazonAthenaFullAccess` (or a more restrictive custom policy) - S3 read/write access to your staging and data directories diff --git a/self-host/customize-deployment/environment-variables.mdx b/self-host/customize-deployment/environment-variables.mdx index a910d1a3..6513f528 100644 --- a/self-host/customize-deployment/environment-variables.mdx +++ b/self-host/customize-deployment/environment-variables.mdx @@ -54,6 +54,12 @@ This is a reference to all environment variables that can be used to configure a Lightdash also accepts all [standard postgres environment variables](https://www.postgresql.org/docs/9.3/libpq-envars.html) +## Athena + +| Variable | Description | +| :---------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `ATHENA_WAREHOUSE_IAM_ROLE_AUTH` | Set to `true` to enable IAM role authentication for Athena warehouse connections. When enabled, users can choose between Access Keys and IAM Role auth in the connection form. IAM Role auth uses the AWS default credential chain (e.g. ECS task role, EC2 instance profile) instead of explicit access keys. Default: `false`. | + ## Snowflake | Variable | Description |