> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Encryption Should Be Enabled For Amazon Athena Group

### More Info:

This rule ensures that encryption of data at rest is enabled for an Amazon Athena workgroup. Enabling encryption at rest helps protect sensitive data stored in Athena workgroups from unauthorized access or tampering. It ensures that data is encrypted while stored, providing an additional layer of security.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of enabling encryption for Amazon Athena Group in AWS RDS using the AWS Management Console, follow these steps:

        1. **Sign in to the AWS Management Console:**
           * Go to [https://aws.amazon.com/](https://aws.amazon.com/) and sign in to the AWS Management Console using your credentials.

        2. **Navigate to the Amazon RDS Console:**
           * Once you are logged in, navigate to the Amazon RDS console by clicking on the "Services" dropdown menu at the top of the page and selecting "RDS" under the Database section.

        3. **Select the RDS Instance:**
           * In the Amazon RDS console, select the RDS instance for which you want to enable encryption by clicking on the checkbox next to the instance.

        4. **Enable Encryption:**
           * Click on the "Modify" button at the top of the page to modify the settings of the selected RDS instance.

        5. **Enable Encryption at Rest:**
           * Scroll down to the "Encryption" section in the Modify DB Instance page.
           * Select the option to enable encryption at rest.
           * Choose the appropriate KMS key from the dropdown menu. If you don't have a KMS key, you can create one by clicking on the "Create New" button.
           * Click on the "Continue" button.

        6. **Apply Changes:**
           * Review the changes you are about to make and ensure that encryption is enabled.
           * Click on the "Modify DB Instance" button to apply the changes to the RDS instance.

        7. **Monitor Encryption Status:**
           * Once the modification is complete, monitor the status of encryption for the RDS instance in the Amazon RDS console.
           * Ensure that the encryption status is shown as "enabled" for the instance.

        By following these steps, you can remediate the misconfiguration of enabling encryption for the Amazon Athena Group in AWS RDS using the AWS Management Console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of enabling encryption for Amazon Athena group in AWS RDS using the AWS CLI, follow these steps:

        1. List the existing RDS DB instances to identify the RDS instance that needs to be encrypted:

        ```bash theme={null}
        aws rds describe-db-instances
        ```

        2. Enable the encryption for the identified RDS DB instance. Replace `your-db-instance-identifier` with the actual identifier of the RDS instance:

        ```bash theme={null}
        aws rds modify-db-instance --db-instance-identifier your-db-instance-identifier --storage-encrypted
        ```

        3. Verify that the encryption is enabled for the RDS instance by describing the instance:

        ```bash theme={null}
        aws rds describe-db-instances --db-instance-identifier your-db-instance-identifier
        ```

        4. Once the encryption is enabled, you can confirm that the Amazon Athena group associated with this RDS instance will also have encryption enabled.

        By following these steps, you can remediate the misconfiguration of enabling encryption for the Amazon Athena group in AWS RDS using the AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of enabling encryption for Amazon Athena Group in AWS RDS using Python, you can follow these steps:

        1. Import the necessary Python libraries:

        ```python theme={null}
        import boto3
        ```

        2. Initialize the AWS RDS client:

        ```python theme={null}
        client = boto3.client('rds')
        ```

        3. Identify the Amazon Athena Group associated with the AWS RDS instance:

        ```python theme={null}
        response = client.describe_db_instances(
            DBInstanceIdentifier='YOUR_DB_INSTANCE_IDENTIFIER'
        )

        db_instance = response['DBInstances'][0]
        ```

        4. Check if the encryption is already enabled for the RDS instance:

        ```python theme={null}
        if not db_instance['StorageEncrypted']:
            # Enable encryption for the RDS instance
            client.modify_db_instance(
                DBInstanceIdentifier='YOUR_DB_INSTANCE_IDENTIFIER',
                StorageEncrypted=True
            )
            print("Encryption enabled for the RDS instance.")
        else:
            print("Encryption is already enabled for the RDS instance.")
        ```

        5. Replace `'YOUR_DB_INSTANCE_IDENTIFIER'` with the actual identifier of your RDS instance.

        6. Run the Python script to enable encryption for the Amazon Athena Group associated with the AWS RDS instance.

        By following these steps, you can remediate the misconfiguration of enabling encryption for the Amazon Athena Group in AWS RDS using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_athena_workgroup" "ATHENA_WORKGROUP" {
          name = "ATHENA_WORKGROUP_NAME" # replace with your Athena workgroup name

          configuration {
            enforce_workgroup_configuration = true

            result_configuration {
              output_location = "s3://ATHENA_QUERY_RESULTS_BUCKET/PREFIX/" # replace with your S3 bucket/prefix

              # Option 1: Enable SSE-S3 for query results (matches first CLI remediation)
              encryption_configuration {
                encryption_option = "SSE_S3"
              }

              # Option 2: Enable SSE-KMS for query results (matches second CLI remediation)
              # encryption_configuration {
              #   encryption_option = "SSE_KMS"
              #   kms_key_arn       = "KMS_KEY_ARN" # replace with your KMS key ARN
              # }
            }
          }
        }
        ```

        Switching between `SSE_S3` and `SSE_KMS` or changing `kms_key_arn` updates the workgroup in place and does not force replacement, but it does immediately change how query result data is encrypted; ensure the KMS key and IAM permissions are correct before applying.

        Verification: `terraform plan` should show an in-place update of `configuration[0].result_configuration[0].encryption_configuration[0].encryption_option` (and `kms_key_arn` if using SSE-KMS) from its previous value to the desired one.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/config/latest/developerguide/athena-workgroup-encrypted-at-rest.html](https://docs.aws.amazon.com/config/latest/developerguide/athena-workgroup-encrypted-at-rest.html)