# Analyze Amazon SageMaker Unified Studio data with external analytics applications through ODBC connection
<a name="query-with-odbc"></a>

Amazon SageMaker Unified Studio enables data consumers to easily locate and subscribe to data from multiple sources within a single project and analyze this data using Amazon Athena, Amazon Redshift Query Editor, and Amazon SageMaker.

Amazon SageMaker Unified Studio also supports authentication through the Athena ODBC driver that enables users to query their subscribed Amazon SageMaker Unified Studio data using popular external SQL and analytics tools, such as Microsoft Power BI, DBeaver, Microsoft Excel, pyodbc, isql, and many others. Users can authenticate using their corporate credentials through SSO or IAM and begin analyzing their subscribed data within their Amazon SageMaker Unified Studio projects.

Amazon SageMaker Unified Studio's support of the Athena ODBC driver provides the following benefits:
+ Greater tool choice for querying and visualization - data consumers can connect to Amazon SageMaker Unified Studio using their preferred tools from a wide range of analytics tools that support an ODBC connection. This enables them to continue using the software they are familiar with without the need to learn new tools for data consumption. 
+ Programmatic access - an ODBC connection to access-governed data through servers or custom applications enables data consumers to perform automated and more complex data operations.

You can use your ODBC connection details to connect your external analytics tools to your Amazon SageMaker Unified Studio subscribed data. You can either copy a complete ODBC connection string for a DSN-less connection, or copy the individual parameters to configure a data source name (DSN). To obtain your ODBC connection details, perform the following procedure:

**Important**  
In the current release, Amazon SageMaker Unified Studio supports authentication using the Amazon Athena ODBC driver, version 2.2.0.1 or later. To complete this procedure, make sure that you have downloaded and installed the latest [Athena ODBC driver](https://docs.aws.amazon.com/athena/latest/ug/odbc-v2-driver.html) for your analytics application of choice. 

1. Navigate to Amazon SageMaker Unified Studio using the URL from your admin and log in using your SSO or AWS credentials. 

1. From the project selector dropdown at the top of the page, choose the project where you have the data that you want to analyze.

1. In the **Project overview**, choose the **JDBC and ODBC connections** tab.

1. In **ODBC connection details**, choose your authentication method (**Using IDC auth** or **Using IAM auth**) and then choose the icon next to the **ODBC connection string** to copy the string, or copy the individual parameters (**domain ID**, **project ID**, **Athena workgroup**, **Region**, and **IAM Identity Center issuer URL**). You can then use them to connect to your external analytics application. 

When you connect your external analytics application to Amazon SageMaker Unified Studio using your ODBC connection string or parameters, you invoke the `RedeemAccessToken` API. The `RedeemAccessToken` API exchanges an Identity Center access token for the `AmazonDataZoneDomainExecutionRole` credentials, which are used to call the `GetEnvironmentCredentials` API.

For more information about the authentication mechanism that uses IAM credentials to connect to data governed by Amazon DataZone in Athena, see [DataZone IAM Credentials Provider](https://docs.aws.amazon.com/athena/latest/ug/jdbc-v3-driver-datazone-iamcp.html). For more information about the authentication mechanism that enables connecting to data governed by Amazon DataZone in Athena using IAM Identity Center, see [DataZone Idc Credentials Provider](https://docs.aws.amazon.com/athena/latest/ug/jdbc-v3-driver-datazone-idc.html).

## Authentication modes
<a name="odbc-auth-modes"></a>

The Amazon Athena ODBC driver supports two authentication modes for Amazon SageMaker Unified Studio:
+ **SageMakerBrowserIdc** (for IDC-based domains) - the driver opens a browser window and authenticates through AWS IAM Identity Center (and your external identity provider, if configured). No local AWS credentials are needed.
+ **SageMakerIam** (for IAM-based and IDC-based domains) - the driver uses AWS credentials from the default credential provider chain.

## Connection string parameters
<a name="odbc-connection-parameters"></a>

When configuring a DSN-less connection or a named DSN, the Athena ODBC driver uses the following Amazon SageMaker Unified Studio parameters:


**Amazon SageMaker Unified Studio ODBC connection string parameters**  

| Parameter | Connection string name | Example | 
| --- | --- | --- | 
| Authentication type | AuthenticationType | SageMakerBrowserIdc | 
| SageMaker domain ID | SageMakerDomainId | dzd-123456example | 
| SageMaker project ID | SageMakerProjectId | abcd12example | 
| SageMaker domain Region | SageMakerDomainRegion | us-east-1 | 
| SSO OIDC start URL | sso\_oidc\_start\_url | https://identitycenter.amazonaws.com/ssoins-0example | 
| SSO OIDC Region | sso\_oidc\_region | us-east-1 | 

## RedeemAccessToken API Reference
<a name="odbc-api-ref"></a>

**Request syntax**

```
POST /sso/redeem-token HTTP/1.1
Content-type: application/json

{
   "domainId": "string",
   "accessToken": "string"
}
```

**Response syntax**

```
HTTP/1.1 200
Content-type: application/json

{
   "credentials": AwsCredentials
}
```

**Response elements**

**credentials**  
The `AmazonDataZoneDomainExecutionRole` credentials that are used to call the `GetEnvironmentCredentials` API.  
Type: Array of `AwsCredentials` objects. This data type includes the following properties:  
+ accessKeyId: AccessKeyId
+ secretAccessKey: SecretAccessKey
+ sessionToken: SessionToken
+ expiration: Timestamp