Skip to main content

Connect Athena to Abacus.AI and use it in ChatLLM

With Cognito and your access model in place, create the RBAC-enabled Athena connector, build a Custom Chatbot on it, and let users sign in.

Step 1: Create an Athena connector with RBAC enabled​

Follow the Athena connector setup instructions and turn on the Enable RBAC toggle. Fill in the additional Cognito fields with the values you noted during Cognito setup:

  • Cognito Domain: the hosted UI domain prefix (e.g. my-app-auth)
  • Cognito App Client ID: from Step 2
  • Cognito User Pool ID: from Step 1 (e.g. us-east-2_aBcDeFgHi)
  • Cognito Identity Pool ID: from Step 4 (e.g. us-east-2:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)

Click Create, then Verify Now to confirm the org-level connector works.

Org-level connector fields (RBAC enabled)​

FieldKeyRequiredDescription
Enable RBACimportRbacYesMust be true to enable user-level authentication
AWS RegionregionYesThe AWS region where Athena and Glue are configured (e.g. us-east-2)
Glue Database NamedatabaseYesThe AWS Glue database containing the tables to query
IAM Role ARNroleArnYesThe ARN of an IAM role that Abacus.AI assumes for org-level access
Athena WorkgroupworkgroupNoThe Athena workgroup to use for queries (defaults to primary)
S3 Output LocationoutputLocationNoS3 path for Athena query results (e.g. s3://my-bucket/query-results/)
Cognito DomaincognitoDomainYes (RBAC)The Cognito hosted UI domain prefix (e.g. my-app-auth)
Cognito App Client IDcognitoAppClientIdYes (RBAC)The Cognito App Client ID for OAuth
Cognito User Pool IDcognitoUserPoolIdYes (RBAC)The Cognito User Pool ID (e.g. us-east-2_aBcDeFgHi)
Cognito Identity Pool IDcognitoIdentityPoolIdYes (RBAC)The Cognito Identity Pool ID for obtaining AWS credentials

What is stored per user​

Each user's connector inherits region, database, cognitoDomain, cognitoAppClientId, cognitoUserPoolId and cognitoIdentityPoolId from the org-level connector, and adds that user's Cognito ID, access and refresh tokens (_id_token, _access_token, _refresh_token) plus is_user_level: true. The refresh token is used to renew credentials automatically.

The user's email and role are determined by the Cognito Identity Pool configuration, which maps the authenticated user to an IAM role controlling the databases, tables and S3 buckets they can access.

Step 2: Build a Custom Chatbot on the connector​

Follow Use a database connector in a Custom Chatbot: create a Custom Chatbot project, train the model with Structured data source → External Databases, select the RBAC-enabled Athena connector from Step 1, then deploy and test it.

Step 3: User authentication flow​

When end users access the chatbot connected to the RBAC-enabled Athena connector:

  1. On their first query, users are prompted to authenticate with their AWS Cognito account and are redirected to the Cognito hosted UI login page.
  2. After successful authentication, Abacus.AI receives OAuth tokens and exchanges them for temporary AWS credentials via the Identity Pool.
  3. All subsequent queries execute with the user's own AWS permissions, and results reflect the access model you configured.

The user's Athena connector appears alongside their other user-level connectors in the Connectors list.

Security considerations​

  • User-level authentication: each user authenticates individually with their Cognito credentials.
  • Permission inheritance: users can only access data according to the IAM roles mapped through the Cognito Identity Pool.
  • Token management: Cognito refresh tokens maintain sessions securely; Abacus.AI refreshes expired tokens automatically.
  • Temporary credentials: AWS credentials obtained via the Identity Pool are temporary and scoped to the user's IAM role.

Best practices:

  1. Cognito user groups: map groups to different IAM roles in the Identity Pool for fine-grained access control.
  2. Lake Formation: use it for column-level and row-level security.
  3. Token expiry: configure appropriate token validity durations in the Cognito App Client settings.
  4. Monitoring: use AWS CloudTrail and Athena query history to audit user access patterns.
  5. Least privilege: grant each role only the minimum permissions needed.

Troubleshooting​

  • Authentication failures: verify the Cognito Domain, App Client ID, User Pool ID and Identity Pool ID on the connector; ensure the App Client's Allowed callback URL is https://abacus.ai/oauth/callback; confirm the user exists in the User Pool and is confirmed and active.
  • "Failed to exchange Cognito auth code for tokens": check that the App Client has the openid and profile OAuth scopes enabled and that the hosted UI domain is configured and reachable.
  • "Failed to get AWS credentials from Cognito Identity Pool": ensure the Identity Pool lists the correct User Pool ID and App Client ID as an authentication provider, and that the authenticated IAM role has the necessary Athena, Glue and S3 permissions.
  • Queries return zero rows (Options B and C): the ${session:UserEmail} tag is not resolving. Add sts:TagSession to the IAM role and confirm the email scope and read attribute on the App Client.
  • Data access errors: check the IAM role permissions for the user's Cognito group and, if used, the Lake Formation grants.

Support resources: the AWS Cognito documentation, the Athena documentation, and support@abacus.ai for platform-specific issues.