AWS athena documentation change

Service: athena · 2026-03-19 · Documentation medium

File: athena/latest/ug/querying-hudi-in-athena-considerations-and-limitations.md

Summary

Added a new section detailing a Lake Formation permissions requirement for the native Hudi connector (version 0.15.0), specifying that permissions must be granted to both the table's data location and its .hoodie metadata directory.

Security assessment

This change adds documentation about a specific security configuration requirement for Lake Formation. It explains that without the correct permissions to the .hoodie directory, queries will fail. This is preventative guidance to avoid permission errors, not a fix for an active security vulnerability. It enhances security documentation by clarifying access control requirements.

Diff

diff --git a/athena/latest/ug/querying-hudi-in-athena-considerations-and-limitations.md b/athena/latest/ug/querying-hudi-in-athena-considerations-and-limitations.md
index 7ec95ddb1..085f2a130 100644
--- a//athena/latest/ug/querying-hudi-in-athena-considerations-and-limitations.md
+++ b//athena/latest/ug/querying-hudi-in-athena-considerations-and-limitations.md
@@ -44,0 +45,2 @@ Failed queries return a message similar to the following:
+  * Lake Formation Permissions on 0.15.0 Hudi Connector – This limitation applies only when you opt in to using the native Hudi connector (version 0.15.0) by setting the table property `athena_enable_native_hudi_connector_implementation` to `true`. By default, Athena uses Hudi connector version 0.14.0, which does not require this additional permission. To query a Lake Formation protected table, you must grant Lake Formation permissions to both the table's data location and the `.hoodie` metadata directory. For example, if your Hudi table is located at `s3://bucket/hudi-table/`, you must register and grant permissions to both `s3://bucket/hudi-table/` and `s3://bucket/hudi-table/.hoodie/` in Lake Formation. The `.hoodie` directory contains metadata files (such as `hoodie.properties`) that Athena needs to read during query planning. Without permissions to the `.hoodie` directory, queries will fail with permission denied errors.
+