Amazon Quick now supports cross-account access for Amazon Athena data sources
Query Athena data across AWS accounts via IAM role chaining — no data copying needed, with costs billed to the data-owning account.
View original announcement →Visual Summary
graph TD
A{{QuickSight Cross-Account Athena}}:::announced
B((BI Users)):::external
C([RunAsRole]):::feature
D([ConsumerAccountRoleArn]):::feature
E(Amazon Athena):::compute
F(Amazon S3 Data):::storage
G([IAM Role Chaining]):::feature
H([Multi-Role Access]):::feature
I([Cost Attribution]):::feature
B ==>|"queries via"| A
A -->|"assumes"| C
C -->|"chains into"| D
D -->|"executes queries"| E
E -->|"scans"| F
A ==>|"leverages"| G
G -->|"enables"| C
G -->|"enables"| D
A -.->|"supports"| H
H -.->|"team segregation"| D
E -.->|"billed to data account"| I
classDef announced fill:#ff9900,stroke:#ec7211,color:#fff,font-weight:bold
classDef compute fill:#e3f2fd,stroke:#1565c0,color:#1565c0
classDef storage fill:#e8f5e9,stroke:#2e7d32,color:#2e7d32
classDef feature fill:#fff3e0,stroke:#e65100,color:#e65100
classDef external fill:#f5f5f5,stroke:#616161,color:#616161
What's New
Amazon QuickSight (referred to as "Amazon Quick" in the announcement) now supports cross-account access for Amazon Athena data sources, allowing users to query Athena data residing in a different AWS account directly from their QuickSight deployment. The feature leverages IAM role chaining to securely bridge accounts, and Athena query costs are billed to the account where the data resides rather than the QuickSight account. Multiple roles per consumer account are supported, enabling fine-grained access control across teams within a single target account.
How It Works
- RunAsRole configuration: Administrators create an Athena data source in QuickSight by specifying a
RunAsRolein the QuickSight (source) account, which QuickSight first assumes when initiating a cross-account query. - ConsumerAccountRoleArn configuration: A
ConsumerAccountRoleArnis specified in the target (consumer) AWS account where the Athena resources and underlying data reside, serving as the second hop in the role chain. - IAM role chaining mechanism: QuickSight executes a two-step role assumption — first assuming the
RunAsRole, then chaining into theConsumerAccountRoleArn— to execute Athena queries in the remote account without requiring data to be copied or moved. - Cost attribution: Athena query execution costs (scanning, compute) are billed to the consumer account where the data lives, not the QuickSight account, aligning costs with data ownership.
- Multiple roles per consumer account: Administrators can configure multiple
ConsumerAccountRoleArnvalues within a single consumer account, allowing different teams or user groups to have distinct, scoped permissions over Athena resources. - Trust policy requirements: The consumer account role must have a trust policy that permits the
RunAsRolefrom the QuickSight account to assume it, following standard AWS cross-account IAM delegation patterns.
Why It's Important
- Eliminates data duplication: Organizations no longer need to copy or replicate Athena datasets into the QuickSight account just to enable analytics, reducing storage costs and data consistency risks.
- Supports centralized BI with decentralized data: Enterprises running a hub-and-spoke AWS account model can maintain a single QuickSight deployment while accessing data distributed across multiple business unit or environment accounts.
- Improves cost transparency: By billing Athena query costs to the account where data resides, teams and cost centers are charged accurately, simplifying FinOps and chargeback models.
- Strengthens security posture: Role chaining ensures that access is governed by IAM policies in both accounts, reducing the need for overly broad cross-account S3 bucket policies or data lake permissions.
- Enables team-level access segregation: Multiple roles per consumer account allow administrators to enforce least-privilege access, ensuring different teams only query the Athena resources they are authorized to use.
How It's Different
- No data movement required: Unlike previous approaches that required ETL pipelines or S3 replication to bring data into the QuickSight account, this feature queries data in place across account boundaries.
- Native IAM role chaining vs. resource-based policies: Rather than relying solely on S3 bucket policies or Glue catalog resource policies for cross-account access, this uses a structured two-role chaining model that is easier to audit and manage.
- Granular multi-role support within a single account: The ability to assign multiple roles per consumer account goes beyond simple cross-account access, enabling team-level or dataset-level permission boundaries within the same target account.
- Cost billed to data owner: Unlike typical QuickSight SPICE or direct query models where costs accrue in the QuickSight account, query costs here are attributed to the consumer account, which is a meaningful operational difference for multi-team billing.
- Integrated with existing QuickSight data source workflow: The feature is configured through the standard QuickSight Athena data source creation flow, requiring no separate tooling or custom connectors.
When to Prefer It
- Multi-account AWS Organizations setups: When your organization uses separate AWS accounts per business unit, environment (dev/prod), or data domain, and you want a single QuickSight instance to serve all of them.
- Centralized analytics platform teams: When a platform or BI team manages QuickSight centrally but data ownership and governance are distributed across multiple product or domain teams in different accounts.
- Strict data residency or governance requirements: When data must remain in its originating account for compliance, audit, or governance reasons, and copying it to another account is not permissible.
- FinOps and chargeback models: When your organization needs Athena query costs attributed to the team or account that owns the data, rather than pooled under a central analytics account.
- Fine-grained team access control: When multiple teams share a single consumer AWS account but require isolated, least-privilege access to different Athena databases or tables within that account.
- Reducing operational overhead: When you want to avoid maintaining ETL pipelines, scheduled data syncs, or SPICE refresh jobs just to make cross-account data available in QuickSight.
Availability
- General Availability (GA): This feature is generally available as of May 8, 2026, and is not in preview.
- Supported regions: Available in all AWS regions where Amazon QuickSight is supported; refer to the official QuickSight regional availability page for the complete list.
- Pricing model: Athena query costs (data scanned) are billed to the consumer account where the Athena resources reside; standard QuickSight pricing applies to the QuickSight account for the data source and user capacity.
- Configuration requirement: Administrators must configure both a
RunAsRolein the QuickSight account and aConsumerAccountRoleArnin the target account, with appropriate IAM trust and permission policies in place. - Multiple roles supported: Multiple
ConsumerAccountRoleArnvalues can be configured per consumer account, supporting team-level access segregation within a single target account. - No additional feature cost noted: The announcement does not indicate a separate charge for the cross-account access capability itself beyond standard Athena and QuickSight pricing.
