Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-12 · how we verify
Use it from the registry
terraform · opentofumodule "athena" {
source = "www.iac-bazaar.com/iac-bazaar/aws-athena/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-athena
An Athena workgroup: where the queries run, what they may cost, and where the
answers land. Works with Terraform and OpenTofu (>= 1.6), AWS provider
>= 6.0, < 7.0.
Query results are a copy of the data. Every query writes its result set to S3, and that bucket is usually not the carefully-governed one holding the source. A workgroup pointed at a shared scratch bucket quietly builds a second, ungoverned copy of whatever anybody has ever selected. That is why the result location and its encryption are the substance of this module rather than the SQL.
enforce_workgroup_configuration is what makes any of it real. Off - the
AWS default - the workgroup's settings are a suggestion: a client may send its
own output location and its own encryption setting, and Athena uses theirs.
Every control here becomes advisory. It defaults to on, and
settings_are_binding is an output so the answer is visible.
bytes_scanned_cutoff_per_query is the only thing between a typo and a bill.
Athena charges per byte scanned; a missing partition predicate on a large table
is one query that scans everything, and nothing stops it by default. This module
sets 10 GiB and a precondition refuses null unless you say you meant it.
Two smaller things it handles:
enable_minimum_encryption_configurationrefuses a query whose results would be unencrypted even when enforcement is off - a second, independent flooracl_configurationwithBUCKET_OWNER_FULL_CONTROLwhen writing into another account's bucket. Without it the objects stay owned by this account and the bucket owner cannot read their own data
Note that a client which does not pass the workgroup name runs in primary,
where none of this applies. Grant athena:StartQueryExecution scoped to this
workgroup.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-dms
ssl_mode defaults to none in AWS, so a task reads your entire production database and writes it elsewhere unencrypted. This defaults to require, refuses none unless stated, and pushes the credential into Secrets Manager rather than state.
aws-aurora
Aurora PostgreSQL/MySQL cluster with instances, parameter groups, Serverless v2 scaling, and enhanced monitoring.
aws-documentdb
A cluster whose two dangerous AWS defaults are inverted: storage encryption is hard-coded on because it cannot be added later, and the master password is never an input - Secrets Manager generates it, so it never reaches the state file.
aws-dynamodb-table
DynamoDB table with GSIs/LSIs, TTL, streams, autoscaling or on-demand, and point-in-time recovery.
aws-elasticache-redis
A cluster-mode-disabled ElastiCache Redis/Valkey cache with encryption at rest and in transit both on, no public exposure, and the subnet group and security group created for you.
aws-memorydb
Durable Redis-compatible storage with an ACL holding real users, authenticated through IAM. MemoryDB ships an ACL named open-access that accepts any connection reaching the port with no credentials; this module will not use it.