Trino / Athena Setup

Use this guide to connect either Amazon Athena (IAM role auth) or a self-hosted Trino deployment (username/password auth).

Overview

Vuon supports two connection patterns under the same Trino / Athena connector:

Prerequisites

Before you start, make sure you have:

• Permission in Vuon to add database connections
• For Athena: IAM permissions to create/update roles and policies
• For Athena: an existing workgroup, catalog/database metadata in Glue, and S3 locations for data and query results
• For self-hosted Trino: coordinator host, port, catalog/schema, and a read-only Trino user

Setup steps

Path A: Amazon Athena (IAM Role (Athena))

Step 1: Create or select the IAM role Vuon should assume

In Vuon, you will enter an IAM Role ARN. That role must trust Vuon's AWS principal.

Example trust policy (replace with the principal provided by your Vuon team):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<vuon-account-id>:role/<vuon-assumer-role>"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

You can verify role trust with:

aws iam get-role --role-name <role-name>

Step 2: Attach least-privilege Athena permissions to that role

The assumed role needs enough access to run Athena queries and read metadata/results.

At minimum, include:

• Athena query actions such as athena:StartQueryExecution, athena:GetQueryExecution, and athena:GetQueryResults
• Glue read actions such as glue:GetDatabase, glue:GetDatabases, glue:GetTable, and glue:GetTables
• S3 read access to source data locations
• S3 read/write access to your Athena results bucket

If your results bucket uses a customer-managed KMS key, also allow decrypt/encrypt for that key.

Step 3: Configure Athena in Vuon

In Vuon:

1. Go to Settings -> Databases -> Add Database
2. Select Trino / Athena
3. Set Authentication Method to IAM Role (Athena)
4. Fill in the fields:

Step 4: Test and save

Click Test Connection. After it succeeds, click Add Connection.

Path B: Self-hosted Trino (Username & Password)

Use this path for Trino deployments you operate directly (for example, Trino on Kubernetes or EC2).

Step 1: Ensure network connectivity

Your Trino coordinator must be reachable from Vuon:

• Public endpoint: allowlist Vuon egress IPs (contact your Vuon team)
• Private endpoint: configure private connectivity, such as AWS PrivateLink

Step 2: Create a read-only Trino user

Create a dedicated user with read-only access to the catalogs and schemas Vuon should query.

Exact commands depend on your Trino authentication plugin and catalog backends.

Step 3: Configure Trino in Vuon

In Vuon:

1. Go to Settings -> Databases -> Add Database
2. Select Trino / Athena
3. Set Authentication Method to Username & Password
4. Fill in the fields:

If your Trino endpoint uses HTTPS, use port 443 and TLS.

Step 4: Test and save

Click Test Connection, then Add Connection.

Step 5 (Optional): Enable file uploads (usertables write access)

If you want Vuon users to upload CSVs and create tables from them, ensure the Vuon role has write access to a schema named usertables in the appropriate catalog.

The exact steps depend on your Trino connector and underlying catalog. In general:

1. Create a usertables schema in the catalog used by your Vuon connection
2. Grant the Vuon role write access to that schema

Consult your Trino administrator or connector documentation for the specific grant syntax.

Verification checklist

After saving, confirm:

• The connection appears in Settings -> Databases
• Status changes from Scanning schema... to discovered tables
• Expected catalogs/schemas are available in query editors

Troubleshooting

Error: not authorized to perform: sts:AssumeRole

The IAM role trust policy does not allow Vuon to assume the role.

Fix: update the role trust policy to include Vuon's AWS principal.

Error: not authorized to perform: athena:StartQueryExecution

Assume-role succeeded, but Athena permissions are missing.

Fix: add Athena query permissions on the target workgroup.

Error: S3 access denied while reading results

Athena can run, but the role cannot read/write the results location.

Fix: grant required S3 permissions (and KMS permissions if applicable) to the assumed role.

Error: timeout / cannot reach Trino host

Vuon cannot reach your Trino coordinator endpoint.

Fix: verify DNS, port, TLS settings, and your network path (public allowlist or private connectivity).

Add Connection stays disabled

Vuon enables Add Connection only after required fields are valid and test connection succeeds.

Fix: re-check required fields and retry Test Connection.

Related documentation

• Connect Your Database
• AWS PrivateLink
• Authentication
• Athena IAM docs

FAQ