How do I troubleshoot the "An error occurred while communicating with Athena" error I receive when I connect to to Athena with a JDBC or ODBC driver?

Resolution

When there's a connection issue between the host where you installed the JDBC or ODBC driver and Athena or AWS Glue endpoints, you receive the following error:

"An error occurred while communicating with Amazon Athena"

To troubleshoot this error, check the connectivity between the driver that's on the installed host and Athena or AWS Glue.

Prerequisites: Before you troubleshoot your connectivity, confirm that the AWS Identity and Access Management (IAM) principal used by your JDBC or ODBC driver has the athena:GetQueryResultsStream policy action. Without this permission, your driver fails to retrieve query results even if network connectivity works. For an example policy, see AWS managed policy: AWSQuicksightAthenaAccess.

Connectivity to Athena

To make sure that you have proper connectivity to Athena, confirm the following conditions are true:

• Your host can connect to Athena with either an Athena public service endpoint or an Athena private endpoint. For more information on setting the endpoint, see JDBC driver endpoint override parameters and ODBC driver endpoint overrides.
• Athena uses port 443 to connect to the host.
• The Athena streaming API streams query results through port 444. When you use a JDBC or ODBC driver, Athena streams the query results through this port to the driver on your client host. Unblock this port when you use a JDBC or ODBC driver to connect to Athena. If you leave this port blocked, then your business intelligence tool might time out or fail to show query results when you run a query.

Athena endpoint connectivity

An Athena endpoint looks similar to athena.us-east-1.amazonaws.com. When you enter the endpoint in a command, make sure that you use the correct AWS Region in the endpoint.

Windows

Note: On Windows 10 and later, the telnet client isn't installed by default.

To turn on Telnet Client, complete the following steps:

1. Open Control Panel.
2. Choose Programs, then choose Turn Windows features on or off.
3. Select Telnet Client, then choose OK.

Or use the Test-NetConnection cmdlet in PowerShell instead.

To test an endpoint's connectivity, run the following command:

telnet athena.region.amazonaws.com 443

-or-

Test-NetConnection -ComputerName athena.region.amazonaws.com -Port 443

Note: Replace region with your Region.

Linux or macOS

Run the following command:

nc -v athena.region.amazonaws.com 443

Note: Replace region with your Region.

If you use a virtual private cloud (VPC) endpoint, then the behavior depends on your private DNS setting. If private DNS is turned on, then the standard Athena endpoint automatically resolves to your VPC endpoint. You don't need to change your commands. If private DNS is turned off, then use the format, VPC_Endpoint_ID.athena.Region.vpce.amazonaws.com. By default, private DNS is turned on.

Important: When you use an AWS PrivateLink endpoint, make sure that the security group attached to the PrivateLink endpoint allows inbound traffic on port 444. For more information, see Connect to Amazon Athena using an interface VPC endpoint and Control access to VPC endpoints using endpoint policies.

Also, make sure that you follow best practices for ODBC or JDBC drivers.

Note: You can also use the preceding commands to test connectivity to port 444.

Connectivity to AWS Glue

Check the connectivity between the host that you installed on the JDBC or ODBC driver to AWS Glue. Your host can connect to AWS Glue with either an AWS Glue public service endpoint or an AWS Glue private service endpoint. For more information, see AWS Glue service endpoints. Athena uses the AWS Glue Data Catalog to store and retrieve table metadata for the Amazon Simple Storage Service (Amazon S3) data in your account. Your driver needs to connect to the AWS Glue catalog successfully to get the table metadata information.

If you use an AWS Glue public service endpoint, then test the connectivity with a command similar to the following example:

Note: You might need to use Test-NetConnection or nc to check the port connectivity based on your Operating System.

telnet glue.us-east-1.amazonaws.com 443

If you use an AWS Glue VPC interface endpoint and you've turned off private DNS for the endpoint, then test the connectivity with a command similar to the following example:

telnet vpce-NAME.glue.us-east-1.vpce.amazonaws.com 443

Note: Replace NAME with your VPC endpoint ID.

Related information

Connect to Amazon Athena with ODBC and JDBC drivers