terraform.aws.security.aws-athena-workgroup-unencrypted.aws-athena-workgroup-unencrypted

profile photo of semgrepsemgrep
Author
unknown
Download Count*
LGPL Commons Clause
License

The AWS Athena Work Group is unencrypted. The AWS KMS encryption key protects backups in the work group. To create your own, create a aws_kms_key resource or use the ARN string of a key in your account.

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: aws-athena-workgroup-unencrypted
    patterns:
      - pattern: |
          resource "aws_athena_workgroup" $ANYTHING {
            ...
            configuration {
              ...
              result_configuration {
                ...
              }
              ...
            }
            ...
          }
      - pattern-not-inside: |
          resource "aws_athena_workgroup" $ANYTHING {
            ...
            configuration {
              ...
              result_configuration {
                ...
                encryption_configuration {
                  ...
                }
                ...
              }
              ...
            }
            ...
          }
    message: The AWS Athena Work Group is unencrypted. The AWS KMS encryption key
      protects backups in the work group. To create your own, create a
      aws_kms_key resource or use the ARN string of a key in your account.
    languages:
      - hcl
    severity: WARNING
    metadata:
      category: security
      technology:
        - terraform
        - aws
      owasp:
        - A03:2017 - Sensitive Data Exposure
        - A04:2021 - Insecure Design
      cwe:
        - "CWE-311: Missing Encryption of Sensitive Data"
      references:
        - https://owasp.org/Top10/A04_2021-Insecure_Design
      subcategory:
        - audit
      likelihood: LOW
      impact: MEDIUM
      confidence: LOW
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      vulnerability_class:
        - Cryptographic Issues

Examples

aws-athena-workgroup-unencrypted.tf

resource "aws_athena_workgroup" "pass" {
  name = "wg-encrypted"

  configuration {
    enforce_workgroup_configuration    = true
    publish_cloudwatch_metrics_enabled = true

    result_configuration {
      output_location = "s3://mys3bucket"
      encryption_configuration {
        encryption_option = "SSE_KMS"
        kms_key_arn       = "mykmsarn"
      }
    }
  }
}
# ruleid: aws-athena-workgroup-unencrypted
resource "aws_athena_workgroup" "fail" {
  name = "wg-non-encrypted"

  configuration {
    enforce_workgroup_configuration    = true
    publish_cloudwatch_metrics_enabled = true

    result_configuration {
      output_location = "s3://mys3bucket"
    }
  }
}