AWS athena medium security documentation change

Service: athena · 2026-01-25 · Security-related medium

File: athena/latest/ug/notebooks-spark-connect.md

Summary

Added section for connecting self-managed clients to Athena Spark with authentication examples

Security assessment

Added AuthToken handling and SSL configuration demonstrates secure connection practices. Explicit security feature documentation for authentication token usage and encrypted connections (use_ssl=true) to prevent unauthorized access.

Diff

diff --git a/athena/latest/ug/notebooks-spark-connect.md b/athena/latest/ug/notebooks-spark-connect.md
index 32b86650c..c5b96b0fd 100644
--- a//athena/latest/ug/notebooks-spark-connect.md
+++ b//athena/latest/ug/notebooks-spark-connect.md
@@ -5 +5 @@
-API/CLI examples (GetSessionEndpoint)
+API/CLI examples (GetSessionEndpoint)Connecting from self-managed clients
@@ -30,0 +31,72 @@ This API returns the Spark Connect endpoint URL for that session.
+## Connecting from self-managed clients
+
+You can connect to an Athena Spark Interactive Session from self-managed clients.
+
+### Pre-requisites
+
+Install the pyspark-connect client for Spark 3.5.6 and the AWS SDK for Python.
+    
+    
+    pip install --user pyspark[connect]==3.5.6
+    pip install --user boto3
+
+The following is a sample Python script to send requests directly to the session endpoint:
+    
+    
+    import boto3
+    import time
+    from pyspark.sql import SparkSession
+    
+    client = boto3.client('athena', region_name='<REGION>')
+    
+    # start the session
+    response = client.start_session(
+        WorkGroup='<WORKGROUP_NAME>',
+        EngineConfiguration={}
+    )
+    
+    # wait for the session endpoint to be ready
+    time.sleep(5)
+    response = client.get_session_endpoint(SessionId=session_id)
+    
+    # construct the authenticated remote url
+    authtoken=response['AuthToken']
+    endpoint_url=response['EndpointUrl']
+    endpoint_url=endpoint_url.replace("https", "sc")+":443/;use_ssl=true;"
+    url_with_headers = (
+        f"{endpoint_url}"
+        f"x-aws-proxy-auth={authtoken}"
+    )
+    
+    # start the Spark session
+    start_time = time.time()
+    spark = SparkSession.builder\
+        .remote(url_with_headers)\
+        .getOrCreate()
+     
+    spark.version 
+    
+    #
+    # Enter your spark code here
+    #
+    
+    # stop the Spark session
+    spark.stop()
+
+The following is a sample Python script to access the live Spark UI or Spark History Server for a session:
+    
+    
+    Region='<REGION>'
+    WorkGroupName='<WORKGROUP_NAME>'
+    SessionId='<SESSION_ID>'
+    Partition='aws'
+    Account='<ACCOUNT_NUMBER>'
+    
+    SessionARN=f"arn:{Partition}:athena:{Region}:{Account}:workgroup/{WorkGroupName}/session/{SessionId}"
+    
+    # invoke the API to get the live UI/persistence UI for a session
+    response = client.get_resource_dashboard(
+        ResourceARN=SessionARN
+    )
+    response['Url']
+