Athena workgroup does not prevent disabling encryption misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_82
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

You can configure settings at the workgroup level, enforce control over the workgroup. This only affects you if you run queries in the workgroup; if you do, workgroup settings are used. If a query runs in a workgroups and the workgroup overrides client-side settings, Athena uses the workgroup's settings for encryption. It also overrides any other settings specified for the query in the console, by using API operations, or with drivers.

How to Fix

Resource: AWS::Athena::WorkGroup

• Arguments: Properties.WorkGroupConfiguration.EnforceWorkGroupConfiguration [source,go]

---

Resources: MyAthenaWorkGroup: Type: AWS::Athena::WorkGroup Properties: ...

• WorkGroupConfiguration:
• EnforceWorkGroupConfiguration: true ...

---