Athena workgroup should enforce workgroup configuration and encrypt query results

What it checks

Athena workgroup: configuration enforcement is disabled or S3 result encryption configuration is missing.

Where it applies

Terraform: aws_athena_workgroup

CloudFormation: AWS::Athena::WorkGroup

How to fix it

1. Enable enforce_workgroup_configuration while preserving the selected storage mode. Athena-managed results use AWS-owned encryption by default, with an optional customer-managed key. For S3 results, configure result_configuration.encryption_configuration with SSE_S3 or SSE_KMS and the intended result destination. Resolve unknown mode inputs before changing storage settings.

Frameworks

• AWS FSBP Athena.1
• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules