假设已设置权限，我能否从我的 AWS 账户为不同的 AWS 账户创建 Athena 表？

Question

I want to give a customer access to data in my account, but building a table around my s3 bucket requires additional overhead as the number of partitions are increasing overtime. In my account, I have a lambda that automatically handles this by dropping/creating Athena tables with the necessary partition projections. I would like to have this same lambda create/drop an Athena table on another AWS account, not owned by me, is this possible? I know I could give each team access to my Athena table, but then all querying costs are accrued by me.

Answer 1

I want to give a customer access to data in my account, but building a table around my s3 bucket requires additional overhead as the number of partitions are increasing overtime.

If I'm not mistaken, you won't have to manage partitions of your Athena/Glue table if you have Partition Projection set up. So if your customer has the right permissions for accessing objects in your S3 bucket, they should be able to run queries via a table defined in their account.

I would like to have this same lambda create/drop an Athena table on another AWS account, not owned by me, is this possible?

Yes, this is certainly possible as long as the correct permissions for creating/deleting tables in Glue are granted.

Answer 2

Based on feedback I received on the issues I was encountering, I ended up not needing to create/drop tables on another AWS account and instead used Athena's ALTER TABLE SET query to properly change the partition projections needed for my Athena table (via the execution of a lambda). Customers are required to do the same for their tables that rely on our s3 data.

Note: If you choose to go this route, make sure that the code that runs the ALTER TABLE SET handles the race condition associated with setting the properties of the table rather than appending to them. (ie If a property value is equal to XYZ and the code responsible for executing the query runs in parallel (via multiple lambda invocations or some sort of parallelism), then you may run into the case that process A attempts to add value T to XYZ while process B attempts to add value C resulting in either XYZT or XYZC instead of the expected XYZTC )