Back to Checks
aws

Athena workgroup encrypts query results in S3 with server-side encryption

athena_workgroup_encryption
Service: athenaSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsAthenaWorkGroup

Athena workgroups are evaluated for encryption of query results to confirm result data is stored encrypted at rest, whether saved in Amazon S3 or via managed query results

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted query outputs can be read at rest by unintended principals through S3 misconfigurations or cross-account access.

Impact: Confidentiality loss, enabling data exfiltration and supporting lateral movement by exposing sensitive fields outside intended boundaries.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks athena_workgroup_encryption

Recommendation

Enable and enforce workgroup result encryption with AWS KMS customer managed keys (SSE_KMS or managed results with a KMS key). Set a minimum encryption level and prevent client overrides. Apply least privilege to key and result access, rotate keys, and audit usage to maintain defense in depth.

Remediation

CLI

aws athena update-work-group --work-group <workgroup_name> --configuration-updates ResultConfigurationUpdates={EncryptionConfiguration={EncryptionOption=SSE_S3}}

Terraform

# Terraform: Enable encryption of Athena workgroup query results
resource "aws_athena_workgroup" "<example_resource_name>" {
  name = "<example_resource_name>"

  configuration {
    result_configuration {
      output_location = "s3://<example_bucket>/"  # Required S3 path for query results
      encryption_configuration {
        encryption_option = "SSE_S3"  # Critical: enables encryption for query results
      }
    }
  }
}

NativeIaC

# CloudFormation: Enable encryption of Athena workgroup query results
Resources:
  <example_resource_name>:
    Type: AWS::Athena::WorkGroup
    Properties:
      Name: <example_resource_name>
      WorkGroupConfiguration:
        ResultConfiguration:
          EncryptionConfiguration:
            EncryptionOption: SSE_S3  # Critical: enables server-side encryption for query results

Other

1In the AWS Console, go to Amazon Athena > Workgroups
2Select the workgroup and click Edit
3Under Query result configuration, set a Results location if empty
4Check Encrypt query results and select SSE-S3
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.athena.athena_client import athena_client


class athena_workgroup_encryption(Check):
    """Check if there are Athena workgroups not encrypting query results"""

    def execute(self):
        """Execute the athena_workgroup_encryption check"""
        findings = []
        for workgroup in athena_client.workgroups.values():
            # Only check for enabled and used workgroups (has recent queries)
            if (
                workgroup.state == "ENABLED" and workgroup.queries
            ) or athena_client.provider.scan_unused_services:
                report = Check_Report_AWS(metadata=self.metadata(), resource=workgroup)

                if workgroup.encryption_configuration.encrypted:
                    report.status = "PASS"
                    report.status_extended = f"Athena WorkGroup {workgroup.name} encrypts the query results using {workgroup.encryption_configuration.encryption_option}."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Athena WorkGroup {workgroup.name} does not encrypt the query results."

                findings.append(report)

        return findings

References