Athena workgroup configuration cannot be client-overridden

Check ID: athena_workgroup_enforce_configuration
Provider: AWS
Service: athena
Severity: MEDIUM
Categories: encryption
Resource type: AwsAthenaWorkGroup

What this check verifies

Athena workgroups that set enforce_workgroup_configuration=true apply the workgroup’s settings to every query, overriding client-side options for results location, expected bucket owner, encryption, and control of objects written to the results bucket.

Risk

Without enforcement, clients may disable or change result encryption, redirect outputs to unintended or cross-account buckets, and bypass retention controls. This enables data exposure (C), result tampering (I), and weak auditability, complicating incident response.

Recommendation

Set enforce_workgroup_configuration=true to centralize control. Require encrypted results (prefer SSE-KMS), restrict output to approved S3 locations with expected bucket owner, and apply least privilege. Monitor results access and logs as part of defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws athena update-work-group --work-group <workgroup_name> --configuration-updates EnforceWorkGroupConfiguration=true

# Terraform: Enable enforcement of workgroup configuration
resource "aws_athena_workgroup" "<example_resource_name>" {
  name = "<example_resource_name>"

  configuration {
    enforce_workgroup_configuration = true  # Critical: forces workgroup settings to override client-side settings
  }
}

# CloudFormation: Enable enforcement of workgroup configuration
Resources:
  <example_resource_name>:
    Type: AWS::Athena::WorkGroup
    Properties:
      Name: <example_resource_name>
      WorkGroupConfiguration:
        EnforceWorkGroupConfiguration: true  # Critical: forces workgroup settings to override client-side settings

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = athena_workgroup_enforce_configuration. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Athena workgroup encrypts query results in S3 Amazon Athena workgroup has CloudWatch logging enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires