如何解决Athena控制台访问时的GetWorkGroup权限错误

当用户访问Athena控制台时，系统会自动尝试调用athena:GetWorkGroup获取**主工作组（primary）**的配置信息，但当前策略仅允许对finance-analyst-dev工作组执行该操作，而AWS权限模型默认拒绝未明确允许的操作，因此触发权限错误。同时需要严格限制用户无法访问主工作组，需调整策略兼容控制台初始化逻辑的同时保持最小权限。

调整策略核心要点：

• 允许athena:ListWorkGroups操作（资源设为*，该操作不支持针对特定工作组的资源级权限，控制台需加载工作组列表）
• 添加显式拒绝语句，禁止用户对主工作组执行任何Athena操作
• 保留原有的finance-analyst-dev工作组权限

修改后的完整策略如下：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "S3Permissions",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:PutObject"
      ],
      "Resource": [
        "arn:aws:s3:::datalake-finance-0123456789123-analytics-dev",
        "arn:aws:s3:::datalake-finance-0123456789123-analytics-dev/*"
      ]
    },
    {
      "Sid": "AthenaPermissions",
      "Effect": "Allow",
      "Action": [
        "athena:StartQueryExecution",
        "athena:GetQueryExecution",
        "athena:GetQueryResults",
        "athena:ListQueryExecutions",
        "athena:GetWorkGroup",
        "athena:CreateNamedQuery",
        "athena:DeleteNamedQuery",
        "athena:GetNamedQuery",
        "athena:ListNamedQueries",
        "athena:BatchGetNamedQuery",
        "athena:BatchGetQueryExecution",
        "athena:UpdateNamedQuery"
      ],
      "Resource": [
        "arn:aws:athena:us-east-1:0123456789123:workgroup/finance-analyst-dev"
      ]
    },
    {
      "Sid": "AthenaListWorkGroupsAllow",
      "Effect": "Allow",
      "Action": "athena:ListWorkGroups",
      "Resource": "*"
    },
    {
      "Sid": "DenyPrimaryWorkGroupAccess",
      "Effect": "Deny",
      "Action": "athena:*",
      "Resource": "arn:aws:athena:us-east-1:0123456789123:workgroup/primary"
    },
    {
      "Sid": "GluePermissions",
      "Effect": "Allow",
      "Action": [
        "glue:GetDatabases",
        "glue:GetTables",
        "glue:GetTable",
        "glue:GetPartitions"
      ],
      "Resource": [
        "arn:aws:glue:us-east-1:0123456789123:catalog",
        "arn:aws:glue:us-east-1:0123456789123:database/finance-analytics-dev",
        "arn:aws:glue:us-east-1:0123456789123:table/finance-analytics-dev/*"
      ]
    }
  ]
}

• AthenaListWorkGroupsAllow语句：允许列出所有工作组以保证控制台正常加载，但用户无法访问主工作组的任何操作（后续显式拒绝优先级更高）
• DenyPrimaryWorkGroupAccess语句：显式拒绝主工作组的所有Athena操作，彻底阻止用户访问主工作组
• 原finance-analyst-dev工作组权限保持不变，确保用户仅能在该工作组执行查询相关操作

内容的提问来源于stack exchange，提问作者Luís Gama