Frequently asked questions

#What is SQLark?

Cloud Certainty SQLark is a better Amazon Athena console with Grafana-like dashboards, and it runs entirely in your own AWS account. Your teams write SQL with autocomplete from the Glue Data Catalog, keep versioned and shared saved queries, chart results, and build dashboards with variables and time ranges, across your AWS accounts and Regions. Administrators grant users and groups access per workgroup and database, AWS enforces every grant, and an audit log and a long query history record who ran what. You install it with one CloudFormation stack, and no data leaves your account.

#Pricing

#How much does it cost?

SQLark is sold on AWS Marketplace with contract pricing: pay monthly, or for 12 months up front.

Prices are in US dollars and billed through your AWS bill. Plans are not priced per user: everyone in your organisation can use SQLark.

#Why do Business and Enterprise appear as add-ons?

On the SQLark listing, Team is the base plan and Business and Enterprise are add-ons to it. For Business, choose Team and the Business add-on; for Enterprise, choose all three. A plan counts only when every plan below it is in the contract too, so an add-on bought on its own grants nothing. Starter is a separate listing, SQLark Starter.

#What else do I pay for?

Athena itself, and the AWS resources the stack uses in your account, are billed to you by AWS as usual. SQLark is serverless, so it costs close to nothing while nobody is using it.

Every query shows its data scanned and estimated cost, and administrators see the totals per day under Administration › Usage (per user and per workgroup on Business and above).

#What happens when the contract ends?

SQLark keeps working on the last plan for up to 72 hours, then every page says a licence is required and only the licence page works for administrators. All data (saved queries, dashboards, history, the audit log) stays in your account, and subscribing again unlocks it. The same 72 hours cover a brief outage of AWS License Manager.

#Plans

#What does each plan include?

• Every plan has the workspace with tabs, the SQL editor with autocomplete, the schema browser, query history, private saved queries and dashboards with versions, every visualisation, variables and time macros, daily usage and cost, connections to other accounts, grants, the audit log, and IAM Identity Center and Cognito sign-in with MFA.
• Team adds shared saved queries and dashboards, snapshots, statements that change data or the catalogue (CREATE TABLE AS, INSERT, ALTER and the like), and SAML and OIDC identity providers.
• Business adds the IP allowlist, daily scan budgets per user, and usage and cost per user and per workgroup.
• Enterprise has the Business features with the highest limits.

#How are AWS accounts counted?

Each distinct AWS account among your connections counts once, the hub account included. A connection can cover many Regions of its account at no extra count. When all are in use, new accounts can't be connected; accounts already connected keep working.

#Deployment

#Which AWS Regions are supported?

Any Region with Amazon Athena, AWS Glue, AWS Lambda, Amazon API Gateway, Amazon DynamoDB, Amplify Hosting, Amazon Cognito, AWS License Manager and Amazon ECS on Fargate, for example us-east-1, eu-west-1, eu-west-2, eu-central-1 and ap-southeast-2. The same template URL works in every Region. The Region you deploy to doesn't limit which Regions you can query: the stack's LocalRegions parameter and each connection list the Regions to show.

#How do I install it?

Subscribe on AWS Marketplace and launch one CloudFormation stack in the account that subscribed. Creation takes about 10 minutes. By default the stack also creates a SQLark Athena workgroup with an encrypted results bucket and a 1 TB per-query scan limit. See Getting started and the installation guide.

#Does anything run in my VPC?

Only a one-off installer task, for about a minute at install and at each upgrade. It needs outbound HTTPS. Nothing accepts inbound connections, and the rest of the stack is serverless.

#Does it work with many AWS accounts?

Yes. Deploy the spoke role template in each account, or across an AWS Organization with a StackSet. SQLark assumes that role with an external ID, and the role's access level (Query or Full) is the upper limit of what it can do there. The template can also create a SQLark workgroup and results bucket in each Region. See Deploy the spoke role in other accounts.

#Can I use my existing workgroups?

Yes. List the buckets they write results to in the ResultBucketNames parameter, or use workgroups whose results are managed by Athena, and grant people access to them by name. See Workgroups.

#Which identity providers work?

Amazon Cognito users (with required MFA) and AWS IAM Identity Center on every plan. Other SAML 2.0 providers, such as Microsoft Entra ID and Okta, and OIDC providers on Team and above. See Identity providers.

#Data and security

#Does any data leave my account?

No. Your data stays in your S3 buckets, Athena writes results to your workgroups' result locations, and everything SQLark stores (connections, grants, saved queries, dashboards, snapshots, query history, the catalogue cache and the audit log) is in DynamoDB in your account. Cloud Certainty runs no service in the data path, and SQLark sends no telemetry. The licence check is a read from AWS License Manager in your own account. The only outbound request to us is the optional daily read of a public release manifest, which sends nothing about you; set UpdateChecks to Disabled to turn it off. See the security overview.

#Can users only see what they are granted?

Yes. Users see no databases until an administrator grants them access, by database and workgroup pattern, per account and Region. Each request runs with short-lived AWS credentials that a session policy limits to the user's grants, so AWS itself refuses a query on a database the user may not query, even inside a join. See Identity and authorization.

#Can one user see another user's results?

Not through SQLark. Results are shown only to the person who ran the query and to administrators, and SQLark's own result reuse returns only your own earlier runs. The one exception is a snapshot (Team and above), which its creator deliberately shares with everyone signed in, after a warning. Outside SQLark, result files are ordinary objects in your results buckets, protected by your S3 and IAM policies.

#Who ran which query?

SQLark's query history records who ran every query, and administrators can see everyone's day by day. In CloudTrail, every Athena, Glue and S3 call SQLark makes carries the user's email as its sourceIdentity, and the role session is named sq-<email>. The Athena console's history doesn't show who ran a query.

#Can SQLark change my data?

Only if you let it. The default access level, Query, allows read-only statements and writing results only. Statements that change data or the catalogue need a connection with the Full access level, the Team plan or above, and a grant with the ddl permission on that database and workgroup, and each one is recorded in the audit log.

#How does it compare?

#Why not the Athena console?

SQLark doesn't replace the AWS console for administering Athena, but it covers what teams miss when they query there:

#Why not Amazon Managed Grafana?

Managed Grafana is a good dashboard tool, but its Athena data source runs every viewer's queries as one workspace role: every viewer sees what that role can see, any editor can query whatever the role can reach, and CloudTrail shows the role, not the person. SQLark runs every query with the viewer's own grants and records their email. It is also a SQL workspace (editor, autocomplete, saved queries, history, downloads), not only dashboards, and it isn't priced per user.

#Why not Amazon QuickSight?

Amazon Quick Sight (part of Amazon Quick Suite) is a business intelligence service for building analyses and reports for business readers, priced per user. SQLark is for people who write SQL: an editor, the catalogue, query history and quick dashboards straight from SQL, at one price for your whole organisation, running in your account.

#Why not SageMaker Unified Studio querybooks?

Unified Studio is the closest AWS-native alternative, and a good choice if your teams already work in its domains and projects. SQLark needs no Studio domain or projects: it is one stack, with access granted per workgroup and database, dashboards with variables and auto-refresh, a long query history across accounts, and an audit log.

#Does SQLark make my Athena queries cheaper?

It helps in several ways:

• Per-user reuse. Running the same SQL again, or opening a dashboard again, within the reuse age (60 minutes by default) shows your earlier result without starting a query.
• Athena result reuse. New queries ask Athena to reuse a recent identical result, which Athena doesn't charge for.
• Scan budgets (Business and above). A daily limit of data scanned per person.
• Workgroup scan limit. The SQLark workgroup cancels any query that scans more than 1 TB (you can change the limit).
• Partition macros. $__partitionFilter and $__timeFilter make dashboard panels read only the partitions in their time range.
• Visibility. Everyone sees the data scanned and estimated cost of each query, and administrators see who and which workgroup scan the most.

#Can it run CREATE TABLE AS or INSERT?

Yes, on Team and above, on a connection with the Full access level, for people with a grant that includes ddl on the database and workgroup. The same applies to ALTER, DROP, MSCK REPAIR TABLE, UNLOAD, OPTIMIZE, VACUUM and the other statements that change data or the catalogue. Each one is recorded in the audit log.

#Does it support federated catalogues and S3 Tables?

Not yet. This release works with the AWS Glue Data Catalog (AwsDataCatalog) of each account and Region. Federated catalogues and Amazon S3 Tables catalogues are on the roadmap.

#Upgrades

#How do I install a new release?

Each release is a new template. Update the stack with the new template URL and keep your parameter values. Administrators see a banner when a new release is out. See the upgrading guide and the release notes.

#How do I change plan?

Email [email protected]: we prepare an AWS Marketplace offer that credits the rest of your current contract. Between Team, Business and Enterprise no stack update is needed: the new limits and features apply when the new contract is active, and SQLark keeps working on your current plan for up to 72 hours while the agreement changes. Your saved queries, dashboards, history and settings stay as they are. See Changing plan.

#Support

#How do I get help?

Basic support is included: email [email protected] with your stack's Region, the release you run (the ProductVersion stack output) and what you see. We respond within one business day. Paid support plans with response times are on the support page.

#Does Cloud Certainty have access to my account?

No. We have no access to your account and SQLark doesn't give us any. When you ask for help, you share what you choose, such as an error message or a query id.