Error "sign In Failed (Status Code = 2000, [Simba][Athenajdbc](100071)" Upon Loading Published Workbook On Tableau Cloud

Issue

When loading a published workbook or refreshing an extract with an Amazon Athena data source in Tableau Cloud, the following error might occur:

"Sign in failed (status code = 2000, [Simba][AthenaJDBC](100071) An error has been thrown from the AWS Athena client. User: arn::aws::iam::XXXXXXXXXXXX:user/Xxxx_Xxxx is not authorized to perform: athena:StartQueryExecution on resource: arn:aws:athena:us-west-2:XXXXXXXXXXXX:workgroup/primary [Execution ID not available] Invalid username or passwo

Environment

Tableau Cloud
Tableau Desktop
Amazon Athena

Resolution

To resolve this issue, the Athena workgroup needs to be specified in the server name URL when first creating the connection in Tableau Desktop. In order to do so, the port and workgroup parameter must be appended as ":443;workgroup=<yourworkgroupname>;" to the server name in the Server field of the connection dialog, for example:

athena.us-xxxx-xx.amazonaws.com:443;workgroup=<yourworkgroupname>;
(Be sure to include a semi-colon at the end or an error will occur.)

Cause

In many cases, you may have already specified the (non-primary) workgroup by using an athena.properties file for the connection in Tableau Desktop. However, when publishing the workbook or data source to Tableau Cloud, the athena.properties file and workgroup parameter do not get transferred. Since Tableau Cloud is unaware of the workgroup parameter, the connection fails as it will default to the primary workgroup.