Connecting Athena to Churney

At a glance: Read-only on hashed views · Personal data hashed in your account · Source data readable only through Athena

Churney assumes an IAM role in your account that trusts only Churney. The role can run queries in a Churney workgroup, read the hashed views in a dedicated database, and write results to an S3 bucket for Churney. Anything that identifies a person is hashed before it leaves your account.

Let Claude set it up

Before you start

• Access to Athena, Glue, S3 and IAM in your AWS account
• The S3 location of each table you share, under Glue > Tables > Location
• Two Google identity ids, which we send you

What to share

As much as you can. Each of these makes the predictions better:

• Payments
• Trials, if you have them
• User demographics, if available
• User activity
• Attribution: your source of truth for campaign performance (UTM, MMP or ad network)

Step 1. Create the hashed views

Create a database for Churney in the Athena query editor.

Create the database

Then create one view per table you share. Each view hashes the columns that can identify a person, such as email, phone, name, birthday and street address. Athena has no * EXCEPT, so list the other columns you share. If a JSON column holds personal data, leave it out and hash the keys you need.

Fill in your names below and copy the SQL. Rather we write the views for you? Use the List your columns tab and send us the result.

Open the SQL builder

Then check a hash. Paste an email or phone number you know is in your data and compare the result with what your view returns.

Open the hash checker

Step 2. Create an S3 bucket and a workgroup

1. In S3, create a bucket churney-athena-unload in your Athena region, with all public access blocked.
2. Under Management, add a lifecycle rule that expires old objects.
3. In Athena, go to Administration > Workgroups and click Create workgroup. Name it churney-workgroup and set the query result location to s3://churney-athena-unload/.

Step 3. Create the IAM policies

Go to IAM > Policies, click Create policy, switch to JSON and create these five. Replace region and account ID. The policies follow your builder settings.

Athena: run queries in the Churney workgroup

S3: write to the Churney bucket

Glue: read the hashed views

Glue: read the source tables. Add a line per table.

S3: read your data, only through Athena. Add a pair per bucket.

Step 4. Create the role

1. Go to IAM > Roles, click Create role and pick Custom trust policy.
2. Paste the trust policy with the two ids we sent you.
3. Attach the five policies and name the role churney-role.

Trust policy

Using Lake Formation permissions? Also grant the role SELECT on the views and their source tables in Lake Formation.

Step 5. Send us the details

• The role ARN
• The data catalog, usually AwsDataCatalog
• The database churney and the views in it
• The bucket churney-athena-unload and the workgroup churney-workgroup
• The region

We take it from there.

What happens on our side

No action needed. This is here for your security review.

• Read-only on your data. The role reads the views in churney. It reads your source data only through Athena, never directly from S3.
• No stored keys. Only Churney's Google identities can assume the role, and each session lasts at most an hour.
• Contained. Queries run in their own workgroup and results land only in the Churney bucket.
• Direct, incremental export. We pull only new or changed rows with a safety window for late data, and copy the results out.

Normalization rules

Normalization rules