Athena workgroup must have query result encryption enabled

High AWS General aws-athena-workgroup-encryption

Applies to

AWS::Athena::WorkGroup

What CGPulse checks

A resource passes this rule when encryptionOption must be set true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Configure encryption for query results (SSE-S3, SSE-KMS, or CSE-KMS) to protect output data at rest. In AWS Console: Athena > Workgroups > select workgroup > Edit > Encrypt query results. See: https://docs.aws.amazon.com/athena/latest/ug/encrypting-query-results-stored-in-s3.html

Terraform

resource "aws_athena_workgroup" "{name}" {
  configuration {
    result_configuration {
      encryption_configuration {
        encryption_option = "SSE_KMS"
      }
    }
  }
}

Compliance frameworks

Cloud Security: AWS Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan