Skip to content

Athena workgroups should have logging enabled

Identifier

athena-enable-logging

Category

Identify > Logging

Description

This control checks whether Amazon Athena workgroups have CloudWatch metrics publishing enabled. Enabling CloudWatch metrics allows you to monitor Athena query performance and usage through metrics like QuerySucceeded, QueryFailed, and ProcessedBytes. This enhances observability and helps detect unusual query activity or performance issues.

Non Compliant Example

Terraform
1
2
3
4
5
6
7
resource "aws_athena_workgroup" "foo" {
    name = "foo"
    configuration {
        enforce_workgroup_configuration    = true
        publish_cloudwatch_metrics_enabled = false
    }
}

Remediation

To fix this violation, enable CloudWatch metrics by setting publish_cloudwatch_metrics_enabled = true in the Athena workgroup configuration:

Terraform
1
2
3
4
5
6
7
resource "aws_athena_workgroup" "foo" {
    name = "foo"
    configuration {
        enforce_workgroup_configuration    = true
        publish_cloudwatch_metrics_enabled = true
    }
}

Extra Resources