No Encryption Override | Vulnerability Database

Athena workgroups should enforce configuration to prevent client disabling encryption

Clients can ignore encryption requirements without enforced configuration. Athena workgroup configuration should be enforced to prevent client side changes to disable encryption settings.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Enforce the configuration to prevent client overrides

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


Resources:
  GoodExample:
    Type: AWS::Athena::WorkGroup
    Properties:
      Name: goodExample
      WorkGroupConfiguration:
        EnforceWorkGroupConfiguration: true
        ResultConfiguration:
          EncryptionConfiguration:
            EncryptionOption: SSE_KMS

Enforce the configuration to prevent client overrides

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


resource "aws_athena_workgroup" "good_example" {
  name = "example"

  configuration {
    enforce_workgroup_configuration    = true
    publish_cloudwatch_metrics_enabled = true

    result_configuration {
      output_location = "s3://${aws_s3_bucket.example.bucket}/output/"

      encryption_configuration {
        encryption_option = "SSE_KMS"
        kms_key_arn       = aws_kms_key.example.arn
      }
    }
  }
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/athena_workgroup#configuration