From 58a14c8042a9f162a032e69bc159da0d945b0232 Mon Sep 17 00:00:00 2001 From: laughingman7743 Date: Fri, 16 Jan 2026 14:13:25 +0900 Subject: [PATCH 1/2] Pass WorkGroup parameter to GetTableMetadata and ListTableMetadata APIs When using PyAthena with a configured work_group, the GetTableMetadata and ListTableMetadata API calls now include the WorkGroup parameter. This allows IAM policies to use specific workgroup ARNs instead of wildcards, improving security posture. Fixes #645 Co-Authored-By: Claude Opus 4.5 --- pyathena/common.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pyathena/common.py b/pyathena/common.py index 5ae96be1..27969a79 100644 --- a/pyathena/common.py +++ b/pyathena/common.py @@ -292,6 +292,8 @@ def _build_list_table_metadata_request( request.update({"Expression": expression}) if next_token: request.update({"NextToken": next_token}) + if self._work_group: + request.update({"WorkGroup": self._work_group}) return request def _build_list_databases_request( @@ -359,11 +361,13 @@ def _get_table_metadata( schema_name: Optional[str] = None, logging_: bool = True, ) -> AthenaTableMetadata: - request = { + request: Dict[str, Any] = { "CatalogName": catalog_name if catalog_name else self._catalog_name, "DatabaseName": schema_name if schema_name else self._schema_name, "TableName": table_name, } + if self._work_group: + request.update({"WorkGroup": self._work_group}) try: response = retry_api_call( self._connection.client.get_table_metadata, From 60e1a0945b6b4963c3cb77a7c76547d971c9b9ec Mon Sep 17 00:00:00 2001 From: laughingman7743 Date: Fri, 16 Jan 2026 15:07:03 +0900 Subject: [PATCH 2/2] Add WorkGroup parameter to ListDatabases API Similar to GetTableMetadata and ListTableMetadata, the ListDatabases API also supports the WorkGroup parameter for IAM Identity Center enabled Glue Data Catalogs. Co-Authored-By: Claude Opus 4.5 --- pyathena/common.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pyathena/common.py b/pyathena/common.py index 27969a79..0890dac3 100644 --- a/pyathena/common.py +++ b/pyathena/common.py @@ -308,6 +308,8 @@ def _build_list_databases_request( } if next_token: request.update({"NextToken": next_token}) + if self._work_group: + request.update({"WorkGroup": self._work_group}) return request def _list_databases(