ODBC Driver for Amazon Athena

Build 20.0.7654

macOS DSN Configuration

This section shows how to set up ODBC connectivity and configure DSNs on macOS.

Minimum macOS Version

The CData ODBC Driver for Amazon Athena driver requires macOS Sierra (10.12) or above.

Licensing the Driver

In a terminal, run the following commands to license the driver. To activate a trial, omit the <key> input.

cd "/Applications/CData ODBC Driver for Amazon Athena/bin"
sudo ./install-license <key>

You'll be prompted for a name and password. These refer to your name and your machine's password.

Connecting through a Driver Manager

On macOS, the CData ODBC Driver for Amazon Athena is preconfigured for use with the iODBC driver manager, as are many other products like Filemaker Pro, Microsoft Excel, and Tableau. You can find the latest version of iODBC on the iODBC site.

The driver installation registers the driver with iODBC and creates a system DSN, which you can use in any tools or applications that support ODBC connectivity.

The driver manager loads the driver and passes function calls from the application to the driver. The driver must be registered with the driver manager and DSNs are defined in the driver manager's configuration files.

Configuring DSNs

To configure a DSN, you can use the iODBC Administrator 64-bit, the GUI installed with iODBC. Note that the ODBC Manager must match the bitness of the ODBC driver. The most recent version of the CData ODBC Driver for Amazon Athena is 64-bit only. Alternatively, you can edit the iODBC configuration files.

You can configure User or System DSNs. User data sources are restricted to a user account. System data sources can be accessed by all users.

Configuring a DSN with the iODBC Administrator

You can create user DSNs by opening the iODBC Administrator 64-bit from Launchpad.

To modify the system DSN installed by the driver or create a system DSN, open the iODBC Administrator 64-bit with elevated permissions. To do so, enter the following command into a terminal:

sudo /Applications/iODBC/iODBC\ Administrator64.app/Contents/MacOS/iODBC\ Administrator64
After opening the iODBC Administrator 64-bit, you will see the CData AmazonAthena Source listed under the System tab. Select the DSN and click the Configure button to set connection properties as name-value pairs.

To create your own DSN, instead click Add on the User or System tab and then select the CData ODBC Driver for Amazon Athena option.

Obtaining the Access Key

To obtain the credentials for an IAM user, follow the steps below:

  1. Sign into the IAM console.
  2. In the navigation pane, select Users.
  3. To create or manage the access keys for a user, select the user and then select the Security Credentials tab.

To obtain the credentials for your AWS root account, follow the steps below:

  1. Sign into the AWS Management console with the credentials for your root account.
  2. Select your account name or number and select My Security Credentials in the menu that is displayed.
  3. Click Continue to Security Credentials and expand the Access Keys section to manage or create root account access keys.

Authenticating with Root Credentials

To authenticate using account root credentials, set the following:

  • AuthScheme: Set this to AwsRootKeys.
  • AWSAccessKey: The access key associated with the AWS root account.
  • AWSSecretKey: The secret key associated with the AWS root account.

Note: Use of this authentication scheme is discouraged by Amazon for anything but simple tests. The account root credentials have the full permissions of the user, making this the least secure authentication method.

Authenticating with Temporary Credentials

To authenticate using temporary credentials, specify the following:

  • AuthScheme: Set this to TemporaryCredentials.
  • AWSAccessKey: The access key of the IAM user to assume the role for.
  • AWSSecretKey: The secret key of the IAM user to assume the role for.
  • AWSSessionToken: Your AWS session token. This will have been provided alongside your temporary credentials. See this link for more info.

The driver can now request resources using the same permissions provided by long-term credentials (such as IAM user credentials) for the lifespan of the temporary credentials.

If you are also using an IAM role to authenticate, you must additionally specify the following:

  • AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This will cause the driver to attempt to retrieve credentials for the specified role.
  • AWSExternalId: Only if required when you assume a role in another account.

Authenticating from an EC2 Instance

If you are using the driver from an EC2 Instance and have an IAM Role assigned to the instance, you can use the IAM Role to authenticate. To do so, set the following properties to authenticate:

  • AuthScheme: Set this to AwsEC2Roles.
Leave AWSAccessKey and AWSSecretKey empty. The driver will automatically obtain your IAM Role credentials and authenticate with them.

If you are also using an IAM role to authenticate, you must additionally specify the following:

  • AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This will cause the driver to attempt to retrieve credentials for the specified role.
  • AWSExternalId: Only if required when you assume a role in another account.

Authenticating as an AWS Role

In many situations it may be preferable to use an IAM role for authentication instead of the direct security credentials of an AWS root user.

To authenticate as an AWS role, set the following:

  • AuthScheme: Set this to AwsIAMRoles.
  • AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This will cause the driver to attempt to retrieve credentials for the specified role.
  • AWSExternalId: Only if required when you assume a role in another account.
If you are connecting to AWS (instead of already being connected such as on an EC2 instance), you must additionally specify the following:
  • AWSAccessKey: The access key of the IAM user to assume the role for.
  • AWSSecretKey: The secret key of the IAM user to assume the role for.

Note: Roles may not be used when specifying the AWSAccessKey and AWSSecretKey of an AWS root user.

Authenticating with SSO

For users and roles that require SSO Authentication, specify the following to authenticate:

  • AuthScheme: Set this to either AwsOKTA or AwsADFS based on the identity provider you would like to use.
  • AWSRoleARN: The Amazon Resource Name of the role to use when authenticating.
  • AWSPrincipalARN: The ARN of the SAML Identity provider in your AWS account.
  • SSOProperties: The SSO properties specific to each Identity Provider. See the SSOProperties page under Connection String Options for more information.
Leave AWSAccessKey and AWSSecretKey empty.

This will cause the driver to submit the SSO credentials in a request to retrieve temporary authentication credentials. Note that the duration of the temporary credentials may be controlled via the TemporaryTokenDuration property (default 3600 seconds).

See SSO Connections for further details.

Authenticating with MFA

For users and roles that require Multi-factor Authentication, specify the following to authenticate:

  • AuthScheme: Set this to AwsMFA.
  • CredentialsLocation: The location of the settings file where MFA credentials are saved. See the Credentials File Location page under Connection String Options for more information.
  • MFASerialNumber: The serial number of the MFA device if one is being used.
  • MFAToken: The temporary token available from your MFA device.
If you are connecting to AWS (instead of already being connected such as on an EC2 instance), you must additionally specify the following:
  • AWSAccessKey: The access key of the IAM user for whom MFA will be issued.
  • AWSSecretKey: The secret key of the IAM user whom MFA will be issued.
If you are also using an IAM role to authenticate, you must additionally specify the following:
  • AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This will cause the driver to attempt to retrieve credentials for the specified role using MFA.
  • AWSExternalId: Only if required when you assume a role in another account.
This will cause the driver to submit the MFA credentials in a request to retrieve temporary authentication credentials.

Note that the duration of the temporary credentials may be controlled via the TemporaryTokenDuration property (default 3600 seconds).

Authenticating with a Credential File

You may use a credentials file to authenticate. Any configurations related to AccessKey/SecretKey authentication, temporary credentials, role authentication, or MFA will be used. To do so, set the following properties to authenticate:

  • AuthScheme: Set this to AwsCredentialsFile.
  • AWSCredentialsFile: Set this to the location of your credentials file.
  • AWSCredentialsFileProfile: Optionally set this to the name of the profile you would like to use from the specified credentials file. If not specified, the profile with the name default will be used.
See this link for more information.

Connecting to Amazon Athena

Once you have configured the driver for your desired authentication method, specify the following to connect to data:

  • Database: The name of the Amazon Athena database to connect to.
  • S3StagingDirectory: Specifies the location Amazon Athena will use to store the results of a query.
  • AWSRegion: Set this to the region where your Amazon Athena data is hosted.
  • S3StagingDirectory: Set this to a folder in S3 where you would like to store the results of queries.

If Database is not set in the connection, the driver connects to the default database set in Amazon Athena.

Configuring a DSN in the iODBC INI Files

Configure DSNs in odbc.ini. Register ODBC drivers in odbcinst.ini.

odbc.ini

Define ODBC data sources in sections in the odbc.ini file. User data sources can only be accessed by the user account whose home folder the odbc.ini is located in. System data sources can be accessed by all users.

PrivilegesPath
User/Users/myuser/Library/ODBC/odbc.ini
System/Library/ODBC/odbc.ini

Modifying iODBC's system-wide settings requires elevated permissions; to do so, you can use the sudo command to open a text editor from the terminal. For example:

sudo nano /Library/ODBC/odbc.ini

In addition to the connection properties required to connect to your data source, the Driver property specifies either a driver definition in the odbcinst.ini file or the path to the driver library.

[CData AmazonAthena Source]
Driver = CData ODBC Driver for Amazon Athena
AWS Access Key=a123
AWS Secret Key=s123
AWS Region=IRELAND
Database=sampledb
S3StagingDirectory=s3://bucket/staging/

Additionally, in the ODBC Data Sources section, the DSN must be set to a driver defined in the odbcinst.ini file. For example, below is the entry for the DSN created during the driver install:

[ODBC Data Sources]
CData AmazonAthena Source = CData ODBC Driver for Amazon Athena

odbcinst.ini

You may need to modify the installed driver definition if you change the path to the driver library.

To register an ODBC driver, modify the odbcinst.ini file. With iODBC, drivers can be available to only one user account or drivers can be available system wide.

PrivilegesPath
User/Users/myuser/Library/ODBC/odbcinst.ini
System/Library/ODBC/odbcinst.ini

Drivers are defined in sections in the odbcinst.ini file. The section name specifies the name of the driver. In this section, the Driver property specifies the path to the driver library. The driver library is the .dylib file located in the lib subfolder of the installation directory, by default in /Applications/CData ODBC Driver for Amazon Athena.

[CData ODBC Driver for Amazon Athena]
Driver = /Applications/CData ODBC Driver for Amazon Athena/lib/libamazonathenaodbc.dylib

The ODBC Drivers section must also contain a property with the driver name, set to "Installed". For example:

[ODBC Drivers]
CData ODBC Driver for Amazon Athena = Installed

Testing the Connection

You can use the iODBC Demo, available in most iODBC installations, to connect to Amazon Athena and execute SQL queries.

iODBC Demo

Complete the following steps to connect from the iODBC Demo:

  • Open Launchpad and search for "iODBC".
  • If you need to connect to Amazon Athena from an application that can use only the ANSI ODBC API, click iODBC Demo Ansi. Otherwise, click iODBC Demo Unicode.
  • In the Environment menu, click Open Connection.
  • Select the DSN on the corresponding tab and test the connection.
You can now execute SQL statements to Amazon Athena by clicking Execute SQL in the SQL menu.

Set the Driver Encoding

The ODBC drivers need to specify which encoding to use with the ODBC Driver Manager. By default, the CData ODBC Drivers for Mac are configured to use UTF-32 which is compatible with iODBC, but other Driver Managers may require alternative encoding.

Alternatively, if you are using the ODBC driver from an application that uses the ANSI ODBC API it may be necessary to set the ANSI code page. For example, to import Japanese characters in an ANSI application, you can specify the code page in the config file '/Applications/CData ODBC Driver for Amazon Athena/lib/cdata.odbc.amazonathena.ini':

[Driver]
AnsiCodePage = 932

Uninstalling the Driver

The easiest way to uninstall the driver is to open a terminal and run the included uninstall.sh script, located in the installation directory. For example:

cd "/Applications/CData ODBC Driver for Amazon Athena"
sudo ./uninstall.sh

Note: The script needs to be run from the installation directory.

Copyright (c) 2020 CData Software, Inc. - All rights reserved.
Build 20.0.7654