Browse your AWS Data Lake tables in your JetBrains IDE, with IAM Identity Center authentication

#datalake #jetbrains #aws #athena

JetBrains IDEs (IntelliJ, PyCharm, PHPStorm) Ultimate Editions come with a powerful database tool. This tool supports AWS Athena, the serverless Trino/Presto query engine, but getting it to work with Identity Center authentication is surprisingly counterintuitive.

In a previous post, I mentioned many tools still expected IAM long-lived credentials (i.e. Access Key ID and Secret Access Key) and weren't designed to accommodate for short-lived credentials (IAM role or Identity Center profiles). This one is no exception.

When you select "AWS Profile" as your authentication option in the setup UI, the tools seems to expect both a User and a Profile, which is surprising, since CLI profiles do not have a "User".

Anything you try results in the same error:

Could not connect: Invalid connection parameter(s): Either a credentials provider or an access key ID and a secret access key must be provided; Either a credentials provider or an access key ID and a secret access key must be provided; Either a credentials provider or an access key ID and a secret access key must be provided;

I had trouble finding the answer on Google, so here it is:

In the General tab, just select "AWS Profile" and leave "User:" and "Profile:" fields empty, only fill the region field with the AWS Region you're using.
In the Advanced tab:
- for the CredentialsProvider key (add it if missing), enter ProfileCredentials.
- for the ProfileName key, enter the name of the profile (from the ~/.aws/config file) you want to use.
- (Don't forget to hit Enter after entering the values, it should display in bold)
- If the Athena WorkGroup you're using (by default, it's set to "primary" doesn't have a default query result location, then you need to add a S3OutputLocation key (a s3://my-bucket/prefix uri)
- Depending on your settings, you might want to change the Catalog (defaults to AwsDataCatalog)