Amazon Athena workgroup has CloudWatch logging enabled

Check ID: athena_workgroup_logging_enabled
Provider: AWS
Service: athena
Severity: MEDIUM
Categories: logging
Resource type: AwsAthenaWorkGroup

What this check verifies

Athena workgroups publish query metrics to CloudWatch. This evaluation determines whether each workgroup has query activity logging enabled in CloudWatch.

Risk

Without CloudWatch query logging, risky or anomalous queries go unobserved, weakening confidentiality and integrity. Compromised or insider accounts can exfiltrate data and alter datasets without timely detection, hampering forensics and containment.

Recommendation

Enable and enforce CloudWatch query logging for all workgroups (PublishCloudWatchMetricsEnabled).

Apply least privilege to logs and encrypt at rest
Set retention and anomaly alerts
Correlate with CloudTrail for user attribution
Centralize logs to a monitoring account

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws athena update-work-group --work-group <WORKGROUP_NAME> --configuration-updates PublishCloudWatchMetricsEnabled=true

# Enable CloudWatch logging for an Athena workgroup
resource "aws_athena_workgroup" "example" {
  name = "<example_resource_name>"

  configuration {
    publish_cloudwatch_metrics_enabled = true  # Critical: Enables CloudWatch logging
  }
}

# CloudFormation to enable CloudWatch logging for an Athena workgroup
Resources:
  AthenaWorkGroup:
    Type: AWS::Athena::WorkGroup
    Properties:
      Name: <example_resource_name>
      WorkGroupConfiguration:
        PublishCloudWatchMetricsEnabled: true  # Critical: Enables CloudWatch logging for the workgroup

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = athena_workgroup_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Athena workgroup configuration cannot be client-overridden [DEPRECATED] Auto Scaling launch config has no secrets

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires