Back to Checks
iac

Athena databases and workgroup configurations are created unencrypted at rest by default, they should be encrypted

AWS-0006
Service: athenaSeverity: high
OfficialBuilt-inVerified

Data can be read if the Athena Database is compromised. Athena databases and workspace result sets should be encrypted at rests. These databases and query sets are generally derived from data in S3 buckets and should have the same level of at rest protection.

Prowler logoProwlerprowler-provider-iac

Run this check with Prowler

Run in Prowler Cloud
Run
prowler iac --checks AWS-0006

Recommendation

Enable encryption at rest for Athena databases and workgroup configurations

Check Code

# METADATA
# title: Athena databases and workgroup configurations are created unencrypted at rest by default, they should be encrypted
# description: |
#   Data can be read if the Athena Database is compromised. Athena databases and workspace result sets should be encrypted at rests. These databases and query sets are generally derived from data in S3 buckets and should have the same level of at rest protection.
# scope: package
# schemas:
#   - input: schema["cloud"]
# related_resources:
#   - https://docs.aws.amazon.com/athena/latest/ug/encryption.html
# custom:
#   id: AWS-0006
#   long_id: aws-athena-enable-at-rest-encryption
#   aliases:
#     - AVD-AWS-0006
#     - enable-at-rest-encryption
#     - aws-athena-enable-at-rest-encryption
#   provider: aws
#   service: athena
#   severity: HIGH
#   recommended_action: Enable encryption at rest for Athena databases and workgroup configurations
#   input:
#     selector:
#       - type: cloud
#         subtypes:
#           - service: athena
#             provider: aws
#   examples: checks/cloud/aws/athena/enable_at_rest_encryption.yaml
package builtin.aws.athena.aws0006

import rego.v1

import data.lib.cloud.metadata
import data.lib.cloud.value

encryption_type_none := ""

deny contains res if {
	some workgroup in input.aws.athena.workgroups
	not_encrypted(workgroup)
	res := result.new(
		"Workgroup does not have encryption configured.",
		metadata.obj_by_path(workgroup, ["encryption", "type"]),
	)
}

deny contains res if {
	some database in input.aws.athena.databases
	not_encrypted(database)
	res := result.new(
		"Database does not have encryption configured.",
		metadata.obj_by_path(database, ["encryption", "type"]),
	)
}

not_encrypted(encryptable) if value.is_equal(encryptable.encryption.type, encryption_type_none)

not_encrypted(encryptable) if not encryptable.encryption.type

References