Amazon Athena

What it is

Amazon Athena runs standard SQL (Structured Query Language)The standard language for querying and changing data in relational databases. Analytics services such as Amazon Athena and Amazon Redshift also use SQL.Glossary entry queries directly on data in Amazon S3. There is no infrastructure to set up and nothing to load: you define a table over files in S3 and query them. Athena is serverless and scales automatically, and you pay for the queries you run. It can also run Apache Spark applications.

Athena suits ad hoc and occasional queries: investigating logs, exploring a Data lakeA central store for large amounts of structured and unstructured data kept in its original form, usually in Amazon S3, which many tools can analyze. AWS Lake Formation helps build and secure one.Glossary entry, or running reports on data that already sits in S3.

How Athena knows the structure of the data

Athena reads table definitions from the AWS Glue Data Catalog: the columns, the data format, and the S3 location. You can create tables with SQL CREATE TABLE statements, or let an AWS Glue crawler discover the schema. The files themselves stay unchanged in S3.

Making queries faster and cheaper

Athena charges by the amount of data each query scans, so anything that reduces the data scanned saves money and time.

Partition the data: store it under prefixes such as year=2026/month=10/. A query that filters on the partition columns in its WHERE clause reads only those partitions. Load new Hive-style partitions with MSCK REPAIR TABLE, or use partition projection, which calculates partitions from table properties instead of looking them up.
Use a Columnar storageStoring data column by column instead of row by row, so that analytical queries read only the columns they need, and similar values compress well. Amazon Redshift and the Parquet and ORC file formats store data this way.Glossary entry: Apache ParquetAn open-source columnar file format for analytics that stores compressed columns along with the schema. Querying Parquet files with Amazon Athena scans less data than CSV or JSON, so it is faster and cheaper.Glossary entry and ORC let Athena read only the columns a query needs and skip blocks that cannot match. Convert existing data with a CREATE TABLE AS SELECT (CTAS) query or an AWS Glue job.
Compress the files: smaller files mean less data to scan.

When a question asks how to reduce Athena cost, the answer is usually Parquet or ORC plus partitioning.

Workgroups

Workgroups separate users, teams, or workloads. Each workgroup can enforce its own query result location and encryption, publish metrics to Amazon CloudWatch, and set data usage controls: a per-query limit that cancels large queries, and a per-workgroup threshold that triggers an alarm. Access to a workgroup is controlled with IAM.

Querying data outside S3

Athena Federated Query runs SQL across data in other sources, such as Amazon DynamoDB, Amazon Redshift, MySQL, PostgreSQL, and Amazon CloudWatch Logs, through data source connectors. You can query the data in place or join it with data in S3. Federated queries cannot write to those sources.

Security, resilience, performance, and cost

Security

IAM controls who can run queries, use workgroups, and read the underlying S3 data and Data Catalog tables. For column-level, row-level, or cell-level control, register the data with AWS Lake Formation, which Athena enforces.
Encrypted data: Athena can query data in S3 encrypted with SSE (Server-side encryption)Encryption that a service applies when it stores your data and removes when you read it back. Amazon S3 encrypts every new object with SSE-S3 by default; SSE-KMS uses keys in AWS KMS instead.Glossary entry-S3, SSE-KMS, or client-side encryption with KMS (CSE-KMS); AWS recommends SSE-KMS when you use Customer managed keyA KMS key that you create, own, and manage: you control its key policy, rotation, and deletion. AWS managed keys, in contrast, are created and managed for you by an AWS service.Glossary entry. Users need kms:Decrypt on the key.
Encrypted results: query results written to the S3 results location can be encrypted too, and a workgroup can enforce the results location and encryption for everyone who uses it.
Private access: an interface VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry (AWS PrivateLink) lets clients in a VPC call Athena without an internet gateway or NAT (Network address translation)Rewriting the IP addresses in packets as they pass through a device, most often so that many private addresses can share one public address to reach the internet.Glossary entry device, and an endpoint policy can restrict it to your organization's identities and resources.

Resilience

Athena is serverless and runs queries on compute across multiple AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry, routing around a zone that is unreachable. The data itself lives in Amazon S3, which is designed for very high durability.

Performance

The levers in "Making queries faster and cheaper" above: partitions, Parquet or ORC, and compression.
Avoid many small files: listing and opening each file adds overhead, and very large numbers of files can hit Amazon S3 request limits. Combine small files into larger ones.
Query result reuse returns a stored result when the same query runs again within a maximum age you choose, so nothing is scanned.
Capacity reservations give a workgroup dedicated processing capacity, measured in DPUs, so important queries are not delayed by others.

Cost

By default you pay per TB of data scanned, so every way of scanning less also costs less. Workgroup data usage controls cancel runaway queries.
With capacity reservations you pay per DPU-hour instead, for predictable spend.
Federated queries are billed by the data they scan too, and query results add normal S3 storage costs.

Monitoring

Workgroups can publish CloudWatch metrics such as ProcessedBytes (data scanned per query), TotalExecutionTime, and QueryQueueTime.
Amazon EventBridge receives a query state change event when a query succeeds, fails, or is cancelled, for example to notify an Amazon SNS topic.
AWS CloudTrail records Athena API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry calls.

Athena or Amazon Redshift?

If the requirement is	Choose
Occasional queries on data that stays in S3, with no infrastructure	Athena
Pay only when queries run	Athena
Many users running frequent, complex reports with consistent performance	Amazon Redshift
A Data warehouseA database designed for analytics, holding cleaned, structured data from many sources, so that reports and queries across years of history run fast. Amazon Redshift is the AWS data warehouse.Glossary entry loaded from many sources	Amazon Redshift

Reverse mindmap: when the question points here

Is it Amazon Athena?

Yes, when the question says
- Query files in S3 with SQL and no infrastructure leads to Athena
- Analyze CloudTrail, VPC Flow Logs, or ALB logs in S3 leads to Athena
- Query DynamoDB or a relational database with SQL in place leads to Federated Query
Make it cheaper and faster
- Reduce the cost of queries on S3 data leads to Parquet or ORC plus partitions
- Limit how much data a team's queries scan leads to Workgroup data usage controls
- The same query runs again and again leads to Query result reuse
- Critical queries must not wait behind others leads to Capacity reservation
Run it securely
- Query data encrypted with a customer managed key leads to SSE-KMS and kms:Decrypt
- Every user's results must be encrypted leads to Workgroup that enforces encryption
- Column or row-level access to tables leads to Lake Formation permissions
- Call Athena from a VPC without internet access leads to Interface VPC endpoint
No, when the question says
- A data warehouse for frequent, complex reporting leads to Amazon Redshift
- Full-text search over logs leads to OpenSearch Service
- Transactional queries for an application leads to Amazon RDS or Aurora

Key takeaways

Athena is serverless SQL on Amazon S3, and you pay for the data each query scans.
Table definitions live in the AWS Glue Data Catalog; the data stays in S3.
Partitions, columnar formats, compression, and fewer, larger files cut cost and time.
Workgroups separate teams, cap the data they scan, and can enforce result encryption.
Lake Formation adds fine-grained permissions; an interface VPC endpoint keeps calls private.