title: "Permission denied" error when sending a query with Athena
body: <h2>Want to Achieve</h2>
  <p>I would like to execute a SELECT statement in AWS Athena, but I am getting the following error.<br />
  Glue catalog is ready, meta information is ready, DDL can be displayed.<br />
  I would appreciate it if you could tell me how to make the query work properly.</p>
  <pre><code>SELECT * FROM &quot;table_name&quot; limit 10;
  </code></pre>
  <p>↓</p>
  <pre><code>Permission denied on S3 path: s3://backet_name/falder_name/db_name/table_name/parquet_name
  </code></pre>
  <p>error_message</p>
  <pre><code>&quot;errorCode&quot;:&quot;AccessDenied&quot;,
  &quot;errorMessage&quot;:&quot;User: arn:aws:sts::&lt;Account_ID&gt;:assumed-role/AWSServiceRoleForLakeFormationDataAccess/AWSLF-00-AT-&lt;Account_ID&gt;-OSSm3ywcAP is not authorized to perform: kms:Decrypt on resource: arn:aws:kms:ap-northeast-1:&lt;Account_ID&gt;:key/○○ because no resource-based policy allows the kms:Decrypt action&quot;
  </code></pre>
  <h2>Environment</h2>
  <p>On AWS
  RDS snapshots are exported to S3 and crawled by Glue to create a data catalog.
  In addition, we are using AWS LakeFormation to manage the data.</p>
  <h2>Setup</h2>
  <h4>AWServiceRoleForLakeFormationDataAccess</h4>
  <p>&quot;AWServiceRoleForLakeFormationDataAccess&quot; is set as the crawler's service role.<br />
  Policies allowed for this role include.<br />
  ・AWSGlueServiceRole<br />
  ・AmazonS3ReadOnlyAccess<br />
  ・kms-decrypt-policy<br />
  ・LakeFormationGetPolicy</p>
  <p>kms-decrypt-policy</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;VisualEditor0&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: &quot;kms:Decrypt&quot;,
              &quot;Resource&quot;: &quot;*&quot;
          }
      ]
  }
  </code></pre>
  <p>LakeFormationGetPolicy</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;VisualEditor0&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;lakeformation:GetResourceLFTags&quot;,
                  &quot;lakeformation:GetDataAccess&quot;,
                  &quot;lakeformation:ListLFTags&quot;,
                  &quot;lakeformation:GetLFTag&quot;
              ],
              &quot;Resource&quot;: &quot;*&quot;
          }
      ]
  }
  </code></pre>
  <h4>Athena Execution User(datalake_user)</h4>
  <p>Attached Policies<br />
  ・AmazonAthenaFullAccess<br />
  ・AmazonS3FullAccess<br />
  ・KMSFullAccessPolicy</p>
  <h4>Lake Formation &gt; Permissions</h4>
  <p><img src="https://ddjkaamml8q8x.cloudfront.net/questions/2022-03-03/6c8b3728-7317-43ee-bfc6-4968d3fc144d.png" alt="イメージ説明" /></p>
  <h4>LF-Tags</h4>
  <p><img src="https://ddjkaamml8q8x.cloudfront.net/questions/2022-03-04/bd1008c5-324c-47c5-bfcf-93098f56df3e.png" alt="イメージ説明" /></p>
  <h4>AWS Lake Formation &gt; Grant permissions &gt; Grant data permissions</h4>
  <p><img src="https://ddjkaamml8q8x.cloudfront.net/questions/2022-03-04/91174686-d60d-4070-9567-94f11a10913c.png" alt="イメージ説明" /></p>
  <p><img src="https://ddjkaamml8q8x.cloudfront.net/questions/2022-03-04/31600ba0-5721-44e2-9c6e-d340f2543fbc.png" alt="イメージ説明" /></p>
  <h4>AWS Lake Formation &gt; Databases &gt; db_sample_for_athena</h4>
  <p><img src="https://ddjkaamml8q8x.cloudfront.net/questions/2022-03-04/d1b289d7-5f73-4fee-b2fd-5daeb0489690.png" alt="イメージ説明" /></p>