Check athena workgroup encrypted at rest remediation

Using Console

To remediate the misconfiguration of enabling encryption for Amazon Athena Group in AWS RDS using the AWS Management Console, follow these steps:

Sign in to the AWS Management Console:
- Go to https://aws.amazon.com/ and sign in to the AWS Management Console using your credentials.
Navigate to the Amazon RDS Console:
- Once you are logged in, navigate to the Amazon RDS console by clicking on the “Services” dropdown menu at the top of the page and selecting “RDS” under the Database section.
Select the RDS Instance:
- In the Amazon RDS console, select the RDS instance for which you want to enable encryption by clicking on the checkbox next to the instance.
Enable Encryption:
- Click on the “Modify” button at the top of the page to modify the settings of the selected RDS instance.
Enable Encryption at Rest:
- Scroll down to the “Encryption” section in the Modify DB Instance page.
- Select the option to enable encryption at rest.
- Choose the appropriate KMS key from the dropdown menu. If you don’t have a KMS key, you can create one by clicking on the “Create New” button.
- Click on the “Continue” button.
Apply Changes:
- Review the changes you are about to make and ensure that encryption is enabled.
- Click on the “Modify DB Instance” button to apply the changes to the RDS instance.
Monitor Encryption Status:
- Once the modification is complete, monitor the status of encryption for the RDS instance in the Amazon RDS console.
- Ensure that the encryption status is shown as “enabled” for the instance.

By following these steps, you can remediate the misconfiguration of enabling encryption for the Amazon Athena Group in AWS RDS using the AWS Management Console.

Using CLI

To remediate the misconfiguration of enabling encryption for Amazon Athena group in AWS RDS using the AWS CLI, follow these steps:

List the existing RDS DB instances to identify the RDS instance that needs to be encrypted:

aws rds describe-db-instances

Enable the encryption for the identified RDS DB instance. Replace your-db-instance-identifier with the actual identifier of the RDS instance:

aws rds modify-db-instance --db-instance-identifier your-db-instance-identifier --storage-encrypted

Verify that the encryption is enabled for the RDS instance by describing the instance:

aws rds describe-db-instances --db-instance-identifier your-db-instance-identifier

Once the encryption is enabled, you can confirm that the Amazon Athena group associated with this RDS instance will also have encryption enabled.

By following these steps, you can remediate the misconfiguration of enabling encryption for the Amazon Athena group in AWS RDS using the AWS CLI.

Using Python

To remediate the misconfiguration of enabling encryption for Amazon Athena Group in AWS RDS using Python, you can follow these steps:

Import the necessary Python libraries:

import boto3

Initialize the AWS RDS client:

client = boto3.client('rds')

Identify the Amazon Athena Group associated with the AWS RDS instance:

response = client.describe_db_instances(
    DBInstanceIdentifier='YOUR_DB_INSTANCE_IDENTIFIER'
)

db_instance = response['DBInstances'][0]

Check if the encryption is already enabled for the RDS instance:

if not db_instance['StorageEncrypted']:
    # Enable encryption for the RDS instance
    client.modify_db_instance(
        DBInstanceIdentifier='YOUR_DB_INSTANCE_IDENTIFIER',
        StorageEncrypted=True
    )
    print("Encryption enabled for the RDS instance.")
else:
    print("Encryption is already enabled for the RDS instance.")

Replace 'YOUR_DB_INSTANCE_IDENTIFIER' with the actual identifier of your RDS instance.
Run the Python script to enable encryption for the Amazon Athena Group associated with the AWS RDS instance.

By following these steps, you can remediate the misconfiguration of enabling encryption for the Amazon Athena Group in AWS RDS using Python.

Using Terraform

resource "aws_athena_workgroup" "ATHENA_WORKGROUP" {
  name = "ATHENA_WORKGROUP_NAME" # replace with your Athena workgroup name

  configuration {
    enforce_workgroup_configuration = true

    result_configuration {
      output_location = "s3://ATHENA_QUERY_RESULTS_BUCKET/PREFIX/" # replace with your S3 bucket/prefix

      # Option 1: Enable SSE-S3 for query results (matches first CLI remediation)
      encryption_configuration {
        encryption_option = "SSE_S3"
      }

      # Option 2: Enable SSE-KMS for query results (matches second CLI remediation)
      # encryption_configuration {
      #   encryption_option = "SSE_KMS"
      #   kms_key_arn       = "KMS_KEY_ARN" # replace with your KMS key ARN
      # }
    }
  }
}

Switching between SSE_S3 and SSE_KMS or changing kms_key_arn updates the workgroup in place and does not force replacement, but it does immediately change how query result data is encrypted; ensure the KMS key and IAM permissions are correct before applying.Verification: terraform plan should show an in-place update of configuration[0].result_configuration[0].encryption_configuration[0].encryption_option (and kms_key_arn if using SSE-KMS) from its previous value to the desired one.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Check athena workgroup encrypted at rest remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation