mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-24 21:11:53 +00:00
chore(aws): enhance metadata for athena service (#8790)
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
This commit is contained in:
Rubén De la Torre Vico
committed by
GitHub
GitHub
parent
d5dac448a6
commit
6e89c301b2
@@ -23,6 +23,8 @@ All notable changes to the **Prowler SDK** are documented in this file.
|
||||
- Update AWS ACM service metadata to new format [(#8716)](https://github.com/prowler-cloud/prowler/pull/8716)
|
||||
- HTML output now properly renders markdown syntax in Risk and Recommendation fields [(#8727)](https://github.com/prowler-cloud/prowler/pull/8727)
|
||||
- Update `moto` dependency from 5.0.28 to 5.1.11 [(#7100)](https://github.com/prowler-cloud/prowler/pull/7100)
|
||||
- Update AWS Athena service metadata to new format [(#8790)](https://github.com/prowler-cloud/prowler/pull/8790)
|
||||
|
||||
|
||||
### Fixed
|
||||
- Fix SNS topics showing empty AWS_ResourceID in Quick Inventory output [(#8762)](https://github.com/prowler-cloud/prowler/issues/8762)
|
||||
|
||||
+24
-12
@@ -1,28 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "athena_workgroup_encryption",
|
||||
"CheckTitle": "Ensure that encryption at rest is enabled for Amazon Athena query results stored in Amazon S3 in order to secure data and meet compliance requirements for data-at-rest encryption.",
|
||||
"CheckTitle": "Athena workgroup encrypts query results in S3 with server-side encryption",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "athena",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:athena:region:account-id:workgroup/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsAthenaWorkGroup",
|
||||
"Description": "Ensure that encryption at rest is enabled for Amazon Athena query results stored in Amazon S3 in order to secure data and meet compliance requirements for data-at-rest encryption.",
|
||||
"Risk": "If not enabled sensitive information at rest is not protected.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/athena/latest/ug/encryption.html",
|
||||
"Description": "**Athena workgroups** are evaluated for **encryption of query results** to confirm result data is stored encrypted at rest, whether saved in Amazon S3 or via managed query results",
|
||||
"Risk": "Unencrypted query outputs can be read at rest by unintended principals through S3 misconfigurations or cross-account access.\n\nImpact: **Confidentiality loss**, enabling **data exfiltration** and supporting **lateral movement** by exposing sensitive fields outside intended boundaries.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://aws.amazon.com/blogs/big-data/introducing-managed-query-results-for-amazon-athena/",
|
||||
"https://docs.aws.amazon.com/athena/latest/ug/managed-results.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Athena/encryption-enabled.html",
|
||||
"https://docs.aws.amazon.com/athena/latest/ug/encrypting-managed-results.html",
|
||||
"https://docs.aws.amazon.com/athena/latest/ug/encrypting-query-results-stored-in-s3.html",
|
||||
"https://docs.aws.amazon.com/athena/latest/ug/workgroups-minimum-encryption.html",
|
||||
"https://aws.amazon.com/blogs/aws/launch-amazon-athena-adds-support-for-querying-encrypted-data/"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws athena update-work-group --region <REGION> --work-group <workgroup_name> --configuration-updates ResultConfigurationUpdates={EncryptionConfiguration={EncryptionOption=SSE_S3|SSE_KMS|CSE_KMS}}",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Athena/encryption-enabled.html",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-that-athena-workgroup-is-encrypted#terraform"
|
||||
"CLI": "aws athena update-work-group --work-group <workgroup_name> --configuration-updates ResultConfigurationUpdates={EncryptionConfiguration={EncryptionOption=SSE_S3}}",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Enable encryption of Athena workgroup query results\nResources:\n <example_resource_name>:\n Type: AWS::Athena::WorkGroup\n Properties:\n Name: <example_resource_name>\n WorkGroupConfiguration:\n ResultConfiguration:\n EncryptionConfiguration:\n EncryptionOption: SSE_S3 # Critical: enables server-side encryption for query results\n```",
|
||||
"Other": "1. In the AWS Console, go to Amazon Athena > Workgroups\n2. Select the workgroup and click Edit\n3. Under Query result configuration, set a Results location if empty\n4. Check Encrypt query results and select SSE-S3\n5. Click Save changes",
|
||||
"Terraform": "```hcl\n# Terraform: Enable encryption of Athena workgroup query results\nresource \"aws_athena_workgroup\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n\n configuration {\n result_configuration {\n output_location = \"s3://<example_bucket>/\" # Required S3 path for query results\n encryption_configuration {\n encryption_option = \"SSE_S3\" # Critical: enables encryption for query results\n }\n }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Enable Encryption. Use a CMK where possible. It will provide additional management and privacy benefits.",
|
||||
"Url": "https://docs.aws.amazon.com/athena/latest/ug/encrypting-query-results-stored-in-s3.html"
|
||||
"Text": "Enable and enforce **workgroup result encryption** with **AWS KMS customer managed keys** (`SSE_KMS` or managed results with a KMS key). Set a minimum encryption level and prevent client overrides. Apply **least privilege** to key and result access, rotate keys, and audit usage to maintain defense in depth.",
|
||||
"Url": "https://hub.prowler.com/check/athena_workgroup_encryption"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+20
-13
@@ -1,31 +1,38 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "athena_workgroup_enforce_configuration",
|
||||
"CheckTitle": "Ensure that workgroup configuration is enforced so it cannot be overriden by client-side settings.",
|
||||
"CheckTitle": "Athena workgroup enforces workgroup configuration and cannot be overridden by client-side settings",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
|
||||
],
|
||||
"ServiceName": "athena",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:athena:region:account-id:workgroup/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsAthenaWorkGroup",
|
||||
"Description": "Ensure that workgroup configuration is enforced so it cannot be overriden by client-side settings.",
|
||||
"Risk": "If workgroup configuration is not enforced security settings like encryption can be overriden by client-side settings.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html",
|
||||
"Description": "**Athena workgroups** that set `enforce_workgroup_configuration=true` apply the **workgroup's settings** to every query, overriding client-side options for results location, expected bucket owner, encryption, and control of objects written to the results bucket.",
|
||||
"Risk": "Without enforcement, clients may disable or change result **encryption**, redirect outputs to unintended or cross-account buckets, and bypass retention controls.\n\nThis enables data exposure (C), result tampering (I), and weak auditability, complicating incident response.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233407-ensure-that-workgroup-configuration-is-enforced-so-it-cannot-be-overriden-by-client-side-settings-"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws athena update-work-group --region <REGION> --work-group <workgroup_name> --configuration-updates EnforceWorkGroupConfiguration=True",
|
||||
"NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/bc_aws_general_33#cloudformation",
|
||||
"Other": "",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/general-policies/bc_aws_general_33#terraform"
|
||||
"CLI": "aws athena update-work-group --work-group <workgroup_name> --configuration-updates EnforceWorkGroupConfiguration=true",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Enable enforcement of workgroup configuration\nResources:\n <example_resource_name>:\n Type: AWS::Athena::WorkGroup\n Properties:\n Name: <example_resource_name>\n WorkGroupConfiguration:\n EnforceWorkGroupConfiguration: true # Critical: forces workgroup settings to override client-side settings\n```",
|
||||
"Other": "1. Open the AWS Management Console and go to Amazon Athena\n2. Click Workgroups, select the target workgroup\n3. Click Edit workgroup\n4. Check Override client-side settings (enforce workgroup settings)\n5. Click Save",
|
||||
"Terraform": "```hcl\n# Terraform: Enable enforcement of workgroup configuration\nresource \"aws_athena_workgroup\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n\n configuration {\n enforce_workgroup_configuration = true # Critical: forces workgroup settings to override client-side settings\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure that workgroup configuration is enforced so it cannot be overriden by client-side settings.",
|
||||
"Url": "https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html"
|
||||
"Text": "Set `enforce_workgroup_configuration=true` to centralize control.\n\nRequire **encrypted results** (prefer **SSE-KMS**), restrict output to approved S3 locations with expected bucket owner, and apply **least privilege**. Monitor results access and logs as part of **defense in depth**.",
|
||||
"Url": "https://hub.prowler.com/check/athena_workgroup_enforce_configuration"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"encryption"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+21
-12
@@ -1,28 +1,37 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "athena_workgroup_logging_enabled",
|
||||
"CheckTitle": "Ensure that logging is enabled for Amazon Athena workgroups to capture query activity.",
|
||||
"CheckTitle": "Amazon Athena workgroup has CloudWatch logging enabled",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Logging"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"TTPs/Defense Evasion"
|
||||
],
|
||||
"ServiceName": "athena",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:athena:region:account-id:workgroup/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsAthenaWorkGroup",
|
||||
"Description": "Enabling logging for a workgroup provides valuable insights into query activity, including user actions, query execution details, and potential security events.",
|
||||
"Risk": "Without logging enabled, it can be difficult to track and investigate potential security incidents or unauthorized access to Athena data. This can lead to data breaches, compliance violations, and increased security risks.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/athena/latest/ug/security-logging-monitoring.html",
|
||||
"Description": "**Athena workgroups** publish **query metrics** to CloudWatch. This evaluation determines whether each workgroup has query activity logging enabled in CloudWatch.",
|
||||
"Risk": "Without CloudWatch query logging, risky or anomalous queries go unobserved, weakening **confidentiality** and **integrity**. Compromised or insider accounts can exfiltrate data and alter datasets without timely detection, hampering forensics and containment.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/athena/latest/ug/security-logging-monitoring.html",
|
||||
"https://docs.aws.amazon.com/athena/latest/ug/athena-cloudwatch-metrics-enable.html",
|
||||
"https://stackoverflow.com/questions/68896809/how-to-save-queries-executed-by-athena-in-logsgroup-cloudwatch",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233405-ensure-that-logging-is-enabled-for-amazon-athena-workgroups-to-capture-query-activity-",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/athena-controls.html#athena-4"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/athena-controls.html#athena-4",
|
||||
"Terraform": ""
|
||||
"CLI": "aws athena update-work-group --work-group <WORKGROUP_NAME> --configuration-updates PublishCloudWatchMetricsEnabled=true",
|
||||
"NativeIaC": "```yaml\n# CloudFormation to enable CloudWatch logging for an Athena workgroup\nResources:\n AthenaWorkGroup:\n Type: AWS::Athena::WorkGroup\n Properties:\n Name: <example_resource_name>\n WorkGroupConfiguration:\n PublishCloudWatchMetricsEnabled: true # Critical: Enables CloudWatch logging for the workgroup\n```",
|
||||
"Other": "1. Open the AWS Management Console and go to Amazon Athena\n2. In the left pane, click Workgroups and select the target workgroup\n3. Click Edit\n4. Check Publish query metrics to AWS CloudWatch\n5. Click Save",
|
||||
"Terraform": "```hcl\n# Enable CloudWatch logging for an Athena workgroup\nresource \"aws_athena_workgroup\" \"example\" {\n name = \"<example_resource_name>\"\n\n configuration {\n publish_cloudwatch_metrics_enabled = true # Critical: Enables CloudWatch logging\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Enable logging for your Athena workgroups to capture query activity and enhance security monitoring. Configure the output location for logs in a secure S3 bucket and ensure appropriate encryption is applied.",
|
||||
"Url": "https://docs.aws.amazon.com/athena/latest/ug/athena-cloudwatch-metrics-enable.html"
|
||||
"Text": "Enable and enforce **CloudWatch query logging** for all workgroups (`PublishCloudWatchMetricsEnabled`).\n- Apply least privilege to logs and encrypt at rest\n- Set retention and anomaly alerts\n- Correlate with **CloudTrail** for user attribution\n- Centralize logs to a monitoring account",
|
||||
"Url": "https://hub.prowler.com/check/athena_workgroup_logging_enabled"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
Reference in New Issue
Block a user