Query Data with Athena

Query Data with Athena

1. Access AWS Management Console

   • Find Athena
   • Select Athena

2. In the Athena interface

   • Select Query editor
   • In Query settings, select Manage

3. In the Manage query result location and encryption section

   • Select Browse S3

4. Next step

   • Select kms-key-s3-<account-id>-<region>-an
   • Press Choose

5. Confirm the query result location is s3://kms-key-s3-<account-id>-<region>-an/, then press Save

6. Go back to the Query editor section

   • Select Editor
   • In the CloudTrail table created from your bucket, select the 3 dots (for example cloudtrail_logs_kms_key_s3_<account-id>_<aws_region>_an_cloudtrail)
   • Select Preview table

7. Scroll down below and you will see that the logs have appeared

8. Try querying the eventname of the kms-key-s3-<account-id>-<region>-an log

   • Enter the following query in the query editor SELECT eventname FROM "default"."cloudtrail_logs_kms_key_s3_<account-id>_<aws_region>_an_cloudtrail" LIMIT 100;
   • Then press Run to execute the query

9. Scroll down and you will see that eventname has been queried successfully