Back to Checks
aws

Amazon Athena workgroup has CloudWatch logging enabled

athena_workgroup_logging_enabled
Service: athenaSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsAthenaWorkGroup

Athena workgroups publish query metrics to CloudWatch. This evaluation determines whether each workgroup has query activity logging enabled in CloudWatch.

Prowler logoProwlerprowler-provider-aws

Risk

Without CloudWatch query logging, risky or anomalous queries go unobserved, weakening confidentiality and integrity. Compromised or insider accounts can exfiltrate data and alter datasets without timely detection, hampering forensics and containment.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks athena_workgroup_logging_enabled

Recommendation

Enable and enforce CloudWatch query logging for all workgroups (PublishCloudWatchMetricsEnabled).

  • Apply least privilege to logs and encrypt at rest
  • Set retention and anomaly alerts
  • Correlate with CloudTrail for user attribution
  • Centralize logs to a monitoring account

Remediation

CLI

aws athena update-work-group --work-group <WORKGROUP_NAME> --configuration-updates PublishCloudWatchMetricsEnabled=true

Terraform

# Enable CloudWatch logging for an Athena workgroup
resource "aws_athena_workgroup" "example" {
  name = "<example_resource_name>"

  configuration {
    publish_cloudwatch_metrics_enabled = true  # Critical: Enables CloudWatch logging
  }
}

NativeIaC

# CloudFormation to enable CloudWatch logging for an Athena workgroup
Resources:
  AthenaWorkGroup:
    Type: AWS::Athena::WorkGroup
    Properties:
      Name: <example_resource_name>
      WorkGroupConfiguration:
        PublishCloudWatchMetricsEnabled: true  # Critical: Enables CloudWatch logging for the workgroup

Other

1Open the AWS Management Console and go to Amazon Athena
2In the left pane, click Workgroups and select the target workgroup
3Click Edit
4Check Publish query metrics to AWS CloudWatch
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.athena.athena_client import athena_client


class athena_workgroup_logging_enabled(Check):
    """Check if there are Athena workgroups with logging disabled."""

    def execute(self) -> List[Check_Report_AWS]:
        """Execute the Athena workgroup logging enabled check.

        Iterates over all Athena workgroups and checks if is publishing logs to CloudWatch.

        Returns:
            List of reports object with the findings of each workgroup.
        """
        findings = []
        for workgroup in athena_client.workgroups.values():
            # Only check for enabled and used workgroups (has recent queries)
            if (
                workgroup.state == "ENABLED" and workgroup.queries
            ) or athena_client.provider.scan_unused_services:
                report = Check_Report_AWS(metadata=self.metadata(), resource=workgroup)
                report.status = "PASS"
                report.status_extended = (
                    f"Athena WorkGroup {workgroup.name} has CloudWatch logging enabled."
                )

                if not workgroup.cloudwatch_logging:
                    report.status = "FAIL"
                    report.status_extended = f"Athena WorkGroup {workgroup.name} does not have CloudWatch logging enabled."

                findings.append(report)

        return findings

References