{
  "Provider": "aws",
  "CheckID": "athena_workgroup_enforce_configuration",
  "CheckTitle": "Ensure that workgroup configuration is enforced so it cannot be overriden by client-side settings.",
  "CheckType": [
    "Software and Configuration Checks"
  ],
  "ServiceName": "athena",
  "SubServiceName": "",
  "ResourceIdTemplate": "arn:partition:athena:region:account-id:workgroup/resource-id",
  "Severity": "medium",
  "ResourceType": "WorkGroup",
  "Description": "Ensure that workgroup configuration is enforced so it cannot be overriden by client-side settings.",
  "Risk": "If workgroup configuration is not enforced security settings like encryption can be overriden by client-side settings.",
  "RelatedUrl": "https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html",
  "Remediation": {
    "Code": {
      "CLI": "aws athena update-work-group --region <REGION> --work-group <workgroup_name> --configuration-updates EnforceWorkGroupConfiguration=True",
      "NativeIaC": "https://docs.bridgecrew.io/docs/bc_aws_general_33#cloudformation",
      "Other": "",
      "Terraform": "https://docs.bridgecrew.io/docs/bc_aws_general_33#terraform"
    },
    "Recommendation": {
      "Text": "Ensure that workgroup configuration is enforced so it cannot be overriden by client-side settings.",
      "Url": "https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html"
    }
  },
  "Categories": [],
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": ""
}