A better Athena console, in your own AWS account.
Cloud Certainty SQLark gives your analysts and engineers one place to write, run, share and chart Amazon Athena queries across your AWS accounts and Regions: an editor that knows your catalogue, the cost of every query, a history that remembers who ran what, and dashboards like Grafana’s, built from plain SQL. You decide who may query which workgroups and databases, and AWS enforces it. It runs entirely in your AWS account, and nothing leaves it.
ONE CLOUDFORMATION STACK · YOUR ACCOUNT · YOUR IDP · EARLY ACCESS · PLANNED FROM $100 A MONTH
Not on AWS Marketplace yet. Early access by email: [email protected].
[ A ] WHAT THE ATHENA CONSOLE LACKS, AND WHAT SQLARK ADDS
The Athena console runs a query and shows the rows. Teams that query every day end up pasting results into spreadsheets, keeping SQL in wikis, running a separate dashboard service on one shared role, and writing IAM policies person by person. SQLark covers the gaps and keeps everything in your account.
Charts
The Athena console:Results are a table and a CSV file. For a chart, AWS points you to another service.
SQLark:Nine visualisations on any result: table, time series, bar, pie, stat, gauge, scatter, heatmap and text, with units, thresholds, legends and fixed series colours. A saved query keeps up to 10 of them.
Dashboards
The Athena console:None.
SQLark:Dashboards on a 24-column grid of panels and rows, each panel from SQL or a saved query, with a time picker, auto-refresh, kiosk mode for a wall display, JSON import and export, and versions you can restore.
Parameters
The Athena console:Positional ? parameters in prepared statements, at most 25 in the console. No dropdowns, no time ranges.
SQLark:Named variables: custom lists, values from a query, text boxes, intervals and constants, multi-value with All, and a panel repeated per value. Time macros such as $__timeFilter and $__partitionFilter put the dashboard’s range into the SQL.
History
The Athena console:Recent queries for 45 days, one workgroup at a time, and nothing says who ran a query.
SQLark:Every query run through SQLark with who ran it, the data scanned, the time and the cost, across workgroups, accounts and Regions, kept from 30 days on Starter to two years on Enterprise. Administrators see everyone’s, day by day.
Saved queries
The Athena console:Tied to one workgroup, with no version history, and moved to another workgroup only by copy and paste.
SQLark:Saved queries with folders, tags, variables and charts, not tied to a workgroup. Every version kept with compare and restore, the last run shown, and a save that never overwrites a colleague’s change. Shared with the team on Team and above.
Sharing results
The Athena console:No way to share a result with a person, and anyone who can read the results bucket reads everyone’s results.
SQLark:Results are shown only to the person who ran the query. To share one, create a snapshot: a frozen copy of a result or a whole dashboard, with an expiry, a confirmation first and an entry in the audit log. Team and above
Cost
The Athena console:Cost per workgroup through cost allocation tags at best; nothing per person or per query.
SQLark:The data scanned and estimated cost of every run, daily totals for administrators, and on Business and above usage and cost per user and per workgroup.
Cost control
The Athena console:One per-query cutoff per workgroup. Workgroup-wide limits only send alerts.
SQLark:Daily scan budgets per user, refused before the query starts. Repeated runs and dashboard refreshes reuse your own recent result or Athena’s, for free. Business and above
Access
The Athena console:Each person needs IAM permissions on the workgroup, Glue, the S3 data, the results location and KMS, written by hand.
SQLark:Grants per user or group: browse, query, download or ddl on workgroup and database patterns such as “sales_*”, per account and Region. AWS enforces them through a session policy on every request, so a table outside the grant is refused even inside a join.
Audit
The Athena console:A query execution has no field for who started it; CloudTrail shows the IAM role.
SQLark:The user’s email is the source identity of every AWS session, so CloudTrail names the person on every Athena, Glue and S3 call. The audit log records administrative changes, write statements, downloads and snapshots.
Many accounts
The Athena console:Sign in to each account and switch Region to see its workgroups and catalogue.
SQLark:One workspace across your AWS accounts and Regions, through a small role in each account, deployed one by one or across an AWS Organization with a StackSet.
[ B ] WHAT YOUR ANALYSTS GET
Write SQL, see what it cost, keep it, chart it and share it, without AWS console access. Users see only the databases and workgroups they are granted, and actions they may not take are greyed out with the reason.
- Workspace
- Tabs, each with its own connection, Region, workgroup and database. A query keeps running when you close the browser; it waits for you in History.
- Editor
- Athena (Trino) highlighting and autocomplete of keywords, functions, databases, tables and columns, with partition columns marked. Error positions underlined, formatting, find and replace, multiple cursors.
- Schema browser
- Databases, tables and views with columns, partitions, format, location, SerDe and view SQL, from a catalogue cache the whole team shares.
- Every run
- Queue, planning and engine time, the data scanned and the estimated cost. One statement at a time, read or write shown before it runs, and Cancel.
- Results
- A typed grid with pages, sorting, search and column filters, which it can run over the whole result in Athena. Download the full result file through a short-lived link, or export the grid.
- History
- Your queries with who ran them, the data scanned, the time and the cost, filtered by source and status, and opened again in a new tab.
- Saved queries
- Folders, tags, descriptions, variables and charts. Every version kept with compare and restore. Private, or shared on Team and above.
- Snapshots
- A frozen copy of a result or a dashboard, readable by everyone signed in, until it expires. Team and above.
- Datasource analytics · eu-west-1
- Workgroup sqlark
- Status Succeeded
- Data scanned 3.2 GB · 4.8 s
- Estimated cost $0.016
- Ran by [email protected]
[ C ] DASHBOARDS FROM PLAIN SQL
A dashboard is a grid of panels, each a SQL query with a visualisation, under one time range and a row of variables. Macros put the range into the SQL, so a panel reads only the partitions it needs, which is what keeps the scan, and the bill, small.
$__timeFilter(col)- A timestamp column between the start and the end of the range
$__dateFilter(col)- The same for a date column
$__partitionFilter(col, 'yyyy/MM/dd')- A string partition column between the two ends, so Athena reads only the partitions in range
$__timeGroup(col, '$__interval')- Time buckets that give about 300 points over the range
$__unixEpochFilter(col)- Unix times in seconds
$__timeFrom(), $__timeTo(), $__range_s- The range itself, for anything else
- Every panel runs with the permissions of the person viewing the dashboard, so a shared dashboard shows each viewer only what their grants allow
- At most 4 panels run at once, backing off when Athena is busy, so a big dashboard never uses up your account’s query quota
- Opening a dashboard again within the reuse age shows your earlier results without starting a query
- Auto-refresh down to 5 minutes on Starter and 10 seconds on Enterprise, paused while the browser tab is hidden
SELECT $__timeGroup(event_time, '$__interval') AS time,
status,
count(*) AS requests
FROM web_logs
WHERE $__partitionFilter(dt, 'yyyy/MM/dd')
AND $__timeFilter(event_time)
AND region IN ($region)
GROUP BY 1, 2
ORDER BY 1$__partitionFilter(dt, 'yyyy/MM/dd') becomes dt BETWEEN '2026/10/07' AND '2026/10/14', so Athena skips every other partition.[ D ] WHAT ADMINISTRATORS CONTROL
Connections
This account from the start; other accounts through a spoke role with an external ID, one by one or across an AWS Organization with a StackSet. Each role has an access level, Query or Full, that SQLark can never exceed.
Workgroups
Use your existing workgroups, or let the stack create a SQLark workgroup per account and Region, with an encrypted results bucket, an expiry on result files and a per-query scan limit.
Grants
browse, query, download and ddl for users and groups from your identity provider, on workgroup and database patterns, per connection and Region. A grant on one database never leaks into another workgroup.
Enforced by AWS
The API checks every grant, and every AWS call runs with credentials a session policy limits to the granted workgroups, databases and result locations. A grant that would not fit is refused, never widened.
Budgets and usage
Daily data scanned per day with its estimated cost, and on Business and above a scan budget per user and the usage per user and per workgroup.
Audit log and settings
Roles, connections, grants and settings changes, write statements, downloads, snapshots and content changes, with the person and source IP. An IP allowlist on Business and above, the reuse age and the price per terabyte.
[ E ] SECURITY
Nothing leaves your account
Your data stays in your S3 buckets and Athena writes results to your workgroups’ locations. Cloud Certainty runs no service in the data path, and SQLark sends no telemetry. The one outbound request is an optional daily read of a public release manifest.
Least privilege, twice
Users see no database until they are granted one. The API checks the grant, then AWS enforces it again through a per-request session policy on Athena, Glue and S3.
Results stay private
A result is shown to the person who ran it and to administrators. SQLark’s own reuse returns only your own earlier runs, and downloads are signed with your own scoped session.
Encryption
The SQLark results bucket is encrypted with SSE-S3 or your KMS key, blocks public access and accepts TLS only. Tables are encrypted at rest, with point-in-time recovery.
Audit
CloudTrail names the person on every AWS call SQLark makes, and the audit log keeps administrative changes, write statements, downloads and snapshots for 30 days to 10 years by plan.
The security overview has the threat model, the IAM roles, the data flows and the shared responsibility a security review needs.
[ F ] RUNS IN YOUR ACCOUNT, FROM LAUNCH TO THE FIRST QUERY
- 01
Deploy
Launch one CloudFormation stack in your own account and Region. It is serverless, so it costs close to nothing while nobody is querying.
Stays in your account
Saved queries, dashboards, history, snapshots, the catalogue cache and the audit log are in DynamoDB in your account. Nothing is sent to Cloud Certainty.
Licensed through AWS
The licence is read from AWS License Manager in your own account. Nothing phones home.
- 02
Sign in
Users sign in through Amazon Cognito with MFA or AWS IAM Identity Center on every plan, or your own SAML or OIDC provider, such as Microsoft Entra ID or Okta, on Team and above.
Only trusted identities
Roles and grants follow the user’s email, so SQLark accepts only emails your directory asserts or has verified.
- 03
Connect accounts
Workgroups and databases in this account are there from the start. Reach other accounts through a small IAM role you deploy in each, at the access level you choose.
The role is the ceiling
With the default Query level, SQLark can run read-only statements and write query results, nothing more. Changing data or the catalogue needs the Full level, the Team plan and a ddl grant.
- 04
Grant and query
Give teams browse, query, download or ddl on their databases. They write SQL, chart it and build dashboards without AWS console access.
Scoped on every request
Each AWS call runs with credentials that last an hour at most, narrowed by a session policy to the user’s grants, Glue and S3 included.
Every query traced
The user’s email is the source identity of every session, so CloudTrail names the person.
One stack: a serverless API (API Gateway and Lambda), the web app on Amplify Hosting, Amazon Cognito sign-in, two DynamoDB tables and, optionally, a SQLark workgroup with its results bucket. The installation guide lists every parameter.
[ G ] PLANS AND PRICING
The pricing planned for the AWS Marketplace launch: contract pricing, monthly or 12 months up front. Plans are not priced per user or per query: everyone in your organisation can use SQLark. Prices in US dollars, billed through your AWS bill.
Starter
For a small team that needs a better editor, history with who ran what and its cost, and private dashboards.
- AWS accounts
- 3
- Saved queries per user
- 50
- Dashboards per user
- 5
- Versions kept per query or dashboard
- 5
- Query history kept
- 30 days
Team
Adds shared saved queries and dashboards, snapshots, statements that change data or the catalogue, and your own SAML or OIDC sign-in.
- AWS accounts
- 10
- Saved queries per user
- 500
- Dashboards per user
- 50
- Versions kept per query or dashboard
- 25
- Query history kept
- 90 days
Business
Adds cost control and governance: daily scan budgets per user, usage and cost per user and workgroup, and the IP allowlist.
- AWS accounts
- 50
- Saved queries per user
- 2,000
- Dashboards per user
- 500
- Versions kept per query or dashboard
- 50
- Query history kept
- 365 days
Enterprise
Everything in Business, with the highest limits and two years of query history.
- AWS accounts
- Unlimited
- Saved queries per user
- Unlimited
- Dashboards per user
- Unlimited
- Versions kept per query or dashboard
- 100
- Query history kept
- 730 days
| Feature | Starter | Team | Business | Enterprise |
|---|---|---|---|---|
| Per month | $100 | $250 | $1,000 | $2,500 |
| 12 months | $1,000 | $2,500 | $10,000 | $25,000 |
| AWS accounts | 3 | 10 | 50 | Unlimited |
| Saved queries per user | 50 | 500 | 2,000 | Unlimited |
| Dashboards per user | 5 | 50 | 500 | Unlimited |
| Versions kept per query or dashboard | 5 | 25 | 50 | 100 |
| Query history kept | 30 days | 90 days | 365 days | 730 days |
| Audit log kept | 30 days | 90 days | 365 days | 3,650 days |
| Fastest dashboard refresh | 5 minutes | 1 minute | 30 seconds | 10 seconds |
| Rows per snapshot | No snapshots | 10,000 | 50,000 | 100,000 |
| Shared saved queries and dashboards | Not included | Included | Included | Included |
| Snapshots of results and dashboards, with an expiry | Not included | Included | Included | Included |
| Statements that change data or the catalogue (CREATE TABLE AS, INSERT, ALTER and the like) | Not included | Included | Included | Included |
| SAML and OIDC identity providers, such as Microsoft Entra ID and Okta | Not included | Included | Included | Included |
| IP allowlist on every API call | Not included | Not included | Included | Included |
| Daily data scanned budgets per user | Not included | Not included | Included | Included |
| Usage and cost per user and per workgroup | Not included | Not included | Included | Included |
Every plan includes
- Workspace with tabs, each with its own connection, Region, workgroup and database
- SQL editor with Athena (Trino) highlighting and autocomplete of databases, tables and columns
- Schema browser and catalogue explorer: columns, partitions, formats, locations and view SQL
- Data scanned, time taken and estimated cost on every run, and who ran it
- Query history across workgroups, accounts and Regions, beyond Athena’s 45 days
- Private saved queries and dashboards with folders, tags and versions you can compare and restore
- Every visualisation, variables and time macros, auto-refresh and kiosk mode
- Per-user result reuse and Athena result reuse, so repeated runs cost nothing
- Grants per user or group, enforced by AWS session policies, with the user’s email in CloudTrail
- Connections to other AWS accounts, optional SQLark workgroups, daily usage totals and an audit log
- Amazon Cognito sign-in with MFA, and IAM Identity Center
Pricing for the launch
SQLark is in early access and not on AWS Marketplace yet. These are the plans and prices planned for the launch. Until then, ask for early access.
Business and Enterprise are add-ons
On the SQLark listing, Team is the base plan. Business is Team plus the Business add-on ($750 a month or $7,500 for 12 months), and Enterprise adds the Enterprise add-on to both ($1,500 a month or $15,000 for 12 months). An add-on on its own grants nothing. Starter is a separate listing, SQLark Starter.
Athena is billed by AWS
Your queries are billed by Athena as usual, about $5 per TB scanned in most Regions, exactly as in the Athena console. SQLark shows the cost of every run, reuses results so repeats are free, and on Business and above caps each person’s daily scan. Lambda, API Gateway, DynamoDB and Cognito cost pennies a month for a team.
Support
Basic support is included. Paid plans with response times, and a fixed-price installation service, are on the support page. Questions about plans: [email protected].
[ H ] QUESTIONS
- Can I use SQLark today?
- It is in early access. It is not on AWS Marketplace yet; email us about your AWS setup and we will set you up ahead of the launch.
- Does any data leave my AWS account?
- No. The stack runs in your account and calls AWS only. Everything SQLark stores is in DynamoDB in your account, and the licence is read from AWS License Manager there.
- Can it change my data?
- Only if you let it. The default Query access level allows read-only statements and writing results. CREATE TABLE AS, INSERT, ALTER and the like need a Full connection, the Team plan or above, and a ddl grant, and each one is audited.
- What does it cost to run?
- The licence is a monthly or 12-month contract. Athena bills your queries as usual, about $5 per TB scanned; SQLark shows that cost on every run and reuses results to keep it down. Lambda, API Gateway, DynamoDB and Cognito cost pennies a month for a team.
More in the FAQ, including how SQLark compares with other tools, and the documentation.
Amazon Web Services, AWS, Amazon Athena, AWS Glue, Amazon S3, AWS CloudTrail and AWS Marketplace are trademarks of Amazon.com, Inc. or its affiliates. Grafana is a trademark of Grafana Labs. SQLark is a product of Cloud Certainty OÜ and is not affiliated with or endorsed by Amazon.