Athena workgroup encrypts query results in S3

Check ID: athena_workgroup_encryption
Provider: AWS
Service: athena
Severity: MEDIUM
Categories: encryption
Resource type: AwsAthenaWorkGroup

What this check verifies

Athena workgroups are evaluated for encryption of query results to confirm result data is stored encrypted at rest, whether saved in Amazon S3 or via managed query results

Risk

Unencrypted query outputs can be read at rest by unintended principals through S3 misconfigurations or cross-account access. Impact: Confidentiality loss, enabling data exfiltration and supporting lateral movement by exposing sensitive fields outside intended boundaries.

Recommendation

Enable and enforce workgroup result encryption with AWS KMS customer managed keys (SSE_KMS or managed results with a KMS key). Set a minimum encryption level and prevent client overrides. Apply least privilege to key and result access, rotate keys, and audit usage to maintain defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws athena update-work-group --work-group <workgroup_name> --configuration-updates ResultConfigurationUpdates={EncryptionConfiguration={EncryptionOption=SSE_S3}}

# Terraform: Enable encryption of Athena workgroup query results
resource "aws_athena_workgroup" "<example_resource_name>" {
  name = "<example_resource_name>"

  configuration {
    result_configuration {
      output_location = "s3://<example_bucket>/"  # Required S3 path for query results
      encryption_configuration {
        encryption_option = "SSE_S3"  # Critical: enables encryption for query results
      }
    }
  }
}

# CloudFormation: Enable encryption of Athena workgroup query results
Resources:
  <example_resource_name>:
    Type: AWS::Athena::WorkGroup
    Properties:
      Name: <example_resource_name>
      WorkGroupConfiguration:
        ResultConfiguration:
          EncryptionConfiguration:
            EncryptionOption: SSE_S3  # Critical: enables server-side encryption for query results

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = athena_workgroup_encryption. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AWS AppSync GraphQL API does not use API key authentication Athena workgroup configuration cannot be client-overridden

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires