Back to Checks
aws

Athena workgroup enforces workgroup configuration and cannot be overridden by client-side settings

athena_workgroup_enforce_configuration
Service: athenaSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsAthenaWorkGroup

Athena workgroups that set enforce_workgroup_configuration=true apply the workgroup's settings to every query, overriding client-side options for results location, expected bucket owner, encryption, and control of objects written to the results bucket.

Prowler logoProwlerprowler-provider-aws

Risk

Without enforcement, clients may disable or change result encryption, redirect outputs to unintended or cross-account buckets, and bypass retention controls.

This enables data exposure (C), result tampering (I), and weak auditability, complicating incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks athena_workgroup_enforce_configuration

Recommendation

Set enforce_workgroup_configuration=true to centralize control.

Require encrypted results (prefer SSE-KMS), restrict output to approved S3 locations with expected bucket owner, and apply least privilege. Monitor results access and logs as part of defense in depth.

Remediation

CLI

aws athena update-work-group --work-group <workgroup_name> --configuration-updates EnforceWorkGroupConfiguration=true

Terraform

# Terraform: Enable enforcement of workgroup configuration
resource "aws_athena_workgroup" "<example_resource_name>" {
  name = "<example_resource_name>"

  configuration {
    enforce_workgroup_configuration = true  # Critical: forces workgroup settings to override client-side settings
  }
}

NativeIaC

# CloudFormation: Enable enforcement of workgroup configuration
Resources:
  <example_resource_name>:
    Type: AWS::Athena::WorkGroup
    Properties:
      Name: <example_resource_name>
      WorkGroupConfiguration:
        EnforceWorkGroupConfiguration: true  # Critical: forces workgroup settings to override client-side settings

Other

1Open the AWS Management Console and go to Amazon Athena
2Click Workgroups, select the target workgroup
3Click Edit workgroup
4Check Override client-side settings (enforce workgroup settings)
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.athena.athena_client import athena_client


class athena_workgroup_enforce_configuration(Check):
    """Check if there are Athena workgroups not encrypting query results"""

    def execute(self):
        """Execute the athena_workgroup_enforce_configuration check"""
        findings = []
        for workgroup in athena_client.workgroups.values():
            # Only check for enabled and used workgroups (has recent queries)
            if (
                workgroup.state == "ENABLED" and workgroup.queries
            ) or athena_client.provider.scan_unused_services:
                report = Check_Report_AWS(metadata=self.metadata(), resource=workgroup)

                if workgroup.enforce_workgroup_configuration:
                    report.status = "PASS"
                    report.status_extended = f"Athena WorkGroup {workgroup.name} enforces the workgroup configuration, so it cannot be overridden by the client-side settings."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Athena WorkGroup {workgroup.name} does not enforce the workgroup configuration, so it can be overridden by the client-side settings."

                findings.append(report)

        return findings

References