---
schema_version: "1"
id: 5a964d585a1aa73f8046d1a76b50ebdbafc4650a640b96d122991e4d8927e6ea
title: Define a Named Credential for Salesforce Connect SQL Adapter for Amazon Athena
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/athena_named_credentials_external_credentials.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.athena_named_credentials_external_credentials.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 4f2c937074a173eda1aaf10f5fe63234a4353fa08ac9ac77bd9b3ec0ac735f4b
description: Create a named credential that specifies the endpoint URL for Amazon Athena and an external credential to provide the required authentication parameters.
products:
  - Salesforce Platform
  - Security
release: "264"
---
# Define a Named Credential for Salesforce Connect SQL Adapter for Amazon Athena

Create a named credential that specifies the endpoint URL for Amazon Athena and an external credential to provide the required authentication parameters.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d174453e60">User Permissions
              Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d174453e60 ">To view named credentials:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d174453e60 ">View Setup and Configuration</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d174453e60 ">To create, edit, or delete named credentials:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d174453e60 ">Manage Named Credentials or Customize Applications</td>

          </tr>
        </tbody>
      </table>

1. From Setup, in the Quick Find box, enter Named Credentials, and then select **Named Credentials**.
2. Click **External Credentials**.
3. To create a new external credential, click **New** . To edit an existing external credential, click its link in the list of external credentials and then click **Edit**.
4. Complete the fields.
    
     
    | Field | Description |
    | --- | --- |
    | Label | A user-friendly name for the named credential that’s displayed in the Salesforce user interface. |
    | Name | A unique identifier that’s used to refer to this external credential from callout definitions while creating an external data source for Amazon Athena. |
    | Authentication Protocol | Select **AWS Signature Version 4**. |
    | Service | The name of an AWS service, such as athena. |
    | Region | The AWS region for the named credential’s endpoint. For example, us-west-2. |
    | AWS Account ID | Optional. The 12-digit number that uniquely identifies your AWS account. |
    | Use STS for Temporary Access | Select the checkbox to provide limited access and specify STS access key, access secret, external ID, and duration. For details, see [Create and Edit an AWS Signature v4 External Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_awssig4_ext_cred.htm&type=5&language=en_US). |
5. Save your changes. You’re taken to the Named Credentials screen.
6. To further edit the new external credential, click **External Credential**.
7. Select the external credential you created.
8. Scroll to Permission Set Mappings.
9. To create a permission set mapping for this external credential, click **New**.
10. Complete these fields. When you use STS for temporary access, the Access Key and Secret fields are disabled and display the temporary credentials, if any.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
            <colgroup>
              <col style="width:25%">
              <col style="width:75%">
            </colgroup>
            <thead class="slds-text-title_caps ">
              <tr class="">
                <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d174453e312">Field</th>
                <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d174453e315">Description</th>
              </tr>
            </thead>
            <tbody>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d174453e312 ">
                  <samp class="parmname">Permission Set</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d174453e315 ">
                  <p>Select an available permission set. When you do, different groups of
                    Salesforce users can mirror access permissions of IAM roles.</p>
                  <p style="margin-bottom:0;">Make sure that
                    you define the required access to the User External Credentials object (use
                    permission sets or profiles to configure object access). Only users with
                    access to the User External Credentials object can make callouts to the
                    external source. For details, see <a href="https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&amp;type=5&amp;language=en_US" target="_blank">Named Credentials and External
                      Credentials</a>.</p>
                </td>

              </tr>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d174453e312 ">
                  <samp class="parmname">Sequence Number</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d174453e315 ">Assign a sequence number. A sequence number specifies the order of
                  principals to apply when a user participates in more than one principal. For
                  example, a user can be part of multiple permission sets that are applicable for
                  a credential provider. Priority is from lower to higher numbers. </td>

              </tr>
              <tr class="">
                <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d174453e312 ">
                  <samp class="parmname">IAM Role ARN</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d174453e315 ">
                  <p>The Amazon Resource Name (ARN) of the role that the credential assumes.</p>
                  <p>To get the ARN for an IAM role:</p>
                  <ol>
                    <li>In the navigation pane of the IAM console, choose
                      <strong class="uicontrol">Roles</strong>.
                    </li>

                    <li>In the list of roles, choose the role that you want to map to the
                      permission set.</li>

                    <li>In the Summary section, copy the ARN value.</li>

                  </ol>
                  <p style="margin-bottom:0;"> For details, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html" target="_blank"><em>AWS Identity and Access Management User
                        Guide</em>: Tutorials</a>.</p>
                </td>

              </tr>
            </tbody>
          </table>
11. Create a named credential that uses the authentication configuration you defined in the external credential. From Setup, in the Quick Find box, enter Named Credentials, select **Named Credentials**, and then click **Named Credentials**.
12. To create a new named credential, click **New** and complete the fields.
    1. Fill out the Label, Name, and URL fields.
        
        The sample format for the URL is `https://athena._REGION_.amazonaws.com`. For example, if the AWS region is us-west-2, the URL is `https://athena.us-west-2.amazonaws.com`.
        
        For details, see [Create and Edit a Named Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_named_credential.htm&type=5&language=en_US).
    2. For the External Credential field, select the external credential you created that uses the AWS Signature Version 4 authentication protocol.
    3. Select Generate Authorization Header.

Use the named credential that captures the authentication configuration in external credentials to authenticate Salesforce users against Amazon Athena, provide limited access to AWS resources, and periodically refresh access tokens.

#### See Also

- [Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_about.htm&type=5&language=en_US)