Question

A data engineering team runs ad hoc Athena queries against a data lake containing regulated financial data. A compliance requirement states that all Athena query result sets written to Amazon S3 must be encrypted with a customer-managed KMS key, and this encryption must be enforced consistently for every analyst regardless of individual query settings. What is the most effective way to satisfy this requirement?

Accepted Answer

Configure the Athena workgroup's result configuration to use SSE-KMS with the customer-managed key and enable the setting that overrides client-side result configuration.

Answer

Attach an S3 bucket policy to the query results bucket that denies any PutObject request, forcing analysts to encrypt manually before writing.

Answer

Instruct each analyst to select the customer-managed KMS key in the Athena console encryption settings before running queries.

Answer

Enable default SSE-S3 encryption on the query results bucket so all objects are automatically encrypted at rest.