title: Allow AWS Athena to query AWS access logs
body: <p>I store my nginx access logs in AWS S3, and I would like to use Athena to query these logs.</p>
  <p>I can successfully create the database table, but when I try to query the logs in the Athena console, I get the following error:</p>
  <pre><code>Your query has the following error(s):
  com.amazonaws.services.s3.model.AmazonS3Exception: Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: XXXXX; S3 Extended Request ID: XXXXXX=; Proxy: null), S3 Extended Request ID: XXXXXX= (Path: s3://your-alb-logs-directory/AWSLogs/XXXXXXXXX/elasticloadbalancing/eu-central-1)
  
  This query ran against the &quot;default&quot; database, unless qualified by the query. Please post the error message on our forum or contact customer support with Query Id: XXXXXXX
  </code></pre>
  <p>This is the query I am trying to run:</p>
  <pre><code>SELECT COUNT(request_verb) AS count,
           request_verb,
           client_ip
  FROM alb_logs
  GROUP BY  request_verb, client_ip LIMIT 100
  </code></pre>
  <p>Any ideas how to fix this?</p>
  <p>The S3 bucket is stored on the same root account.</p>
  <p>I tried to add the following policy to the Athena s3 query bucket:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2008-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: &quot;*&quot;,
              &quot;Action&quot;: [
                  &quot;s3:ListBucket&quot;,
                  &quot;s3:PutObject&quot;,
                  &quot;s3:GetObject&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:s3:::my-bucket/*&quot;,
                  &quot;arn:aws:s3:::my-bucket&quot;
              ]
          }
      ]
  }
  </code></pre>