Athena workgroups should have logging enabled

Checks that the Athena workgroup publishes query metrics to CloudWatch, which is what AWS's control counts as logging for a workgroup; one with the setting off fails. The metrics give each query's data scanned, run time and outcome, so unusual query activity in the workgroup can be seen and investigated.

service: Athena
severity: Medium
scope: evaluated in every region

How to fix it

In the console

Athena → Workgroups → the workgroup → Edit → Settings

Publish query metrics to AWS CloudWatch: Selected

With the AWS CLI

aws athena update-work-group --work-group <workgroup-name> --configuration-updates PublishCloudWatchMetricsEnabled=true --region <region>

With Terraform

resource "aws_athena_workgroup" "this" {
  name = var.workgroup_name

  configuration {
    publish_cloudwatch_metrics_enabled = true
  }
}

See which of your accounts this check is failing on.

Book a live scan