Salesforce Docs Portal

Define a Named Credential for Salesforce Connect SQL Adapter for Amazon Athena

Create a named credential that specifies the endpoint URL for Amazon Athena and an external credential to provide the required authentication parameters.

Required Editions

Available in: both Salesforce Classic and Lightning Experience
Available in: all editions
User Permissions Needed
To view named credentials: View Setup and Configuration
To create, edit, or delete named credentials: Manage Named Credentials or Customize Applications
  1. From Setup, in the Quick Find box, enter Named Credentials, and then select Named Credentials.
  2. Click External Credentials.
  3. To create a new external credential, click New . To edit an existing external credential, click its link in the list of external credentials and then click Edit.
  4. Complete the fields.
    Field Description
    Label A user-friendly name for the named credential that’s displayed in the Salesforce user interface.
    Name A unique identifier that’s used to refer to this external credential from callout definitions while creating an external data source for Amazon Athena.
    Authentication Protocol Select AWS Signature Version 4.
    Service The name of an AWS service, such as athena.
    Region The AWS region for the named credential’s endpoint. For example, us-west-2.
    AWS Account ID Optional. The 12-digit number that uniquely identifies your AWS account.
    Use STS for Temporary Access Select the checkbox to provide limited access and specify STS access key, access secret, external ID, and duration. For details, see Create and Edit an AWS Signature v4 External Credential.
  5. Save your changes. You’re taken to the Named Credentials screen.
  6. To further edit the new external credential, click External Credential.
  7. Select the external credential you created.
  8. Scroll to Permission Set Mappings.
  9. To create a permission set mapping for this external credential, click New.
  10. Complete these fields. When you use STS for temporary access, the Access Key and Secret fields are disabled and display the temporary credentials, if any.
    Field Description
    Permission Set

    Select an available permission set. When you do, different groups of Salesforce users can mirror access permissions of IAM roles.

    Make sure that you define the required access to the User External Credentials object (use permission sets or profiles to configure object access). Only users with access to the User External Credentials object can make callouts to the external source. For details, see Named Credentials and External Credentials.
    Sequence Number Assign a sequence number. A sequence number specifies the order of principals to apply when a user participates in more than one principal. For example, a user can be part of multiple permission sets that are applicable for a credential provider. Priority is from lower to higher numbers.
    IAM Role ARN

    The Amazon Resource Name (ARN) of the role that the credential assumes.

    To get the ARN for an IAM role:

    1. In the navigation pane of the IAM console, choose Roles.
    2. In the list of roles, choose the role that you want to map to the permission set.
    3. In the Summary section, copy the ARN value.

    For details, see AWS Identity and Access Management User Guide: Tutorials.
  11. Create a named credential that uses the authentication configuration you defined in the external credential. From Setup, in the Quick Find box, enter Named Credentials, select Named Credentials, and then click Named Credentials.
  12. To create a new named credential, click New and complete the fields.
    1. Fill out the Label, Name, and URL fields.
      The sample format for the URL is https://athena.REGION.amazonaws.com. For example, if the AWS region is us-west-2, the URL is https://athena.us-west-2.amazonaws.com.

      For details, see Create and Edit a Named Credential.

    2. For the External Credential field, select the external credential you created that uses the AWS Signature Version 4 authentication protocol.
    3. Select Generate Authorization Header.

Use the named credential that captures the authentication configuration in external credentials to authenticate Salesforce users against Amazon Athena, provide limited access to AWS resources, and periodically refresh access tokens.

See Also