AWS athena medium security documentation change
Summary
Added note about partial result cleanup and multipart upload lifecycle recommendations
Security assessment
Addresses potential data exposure risks by advising cleanup of partial results and implementing S3 lifecycle policies to prevent incomplete multipart uploads containing sensitive data.
Diff
diff --git a/athena/latest/ug/querying.md b/athena/latest/ug/querying.md index 8fb639c1c..9545edc4d 100644 --- a//athena/latest/ug/querying.md +++ b//athena/latest/ug/querying.md @@ -18,0 +19,9 @@ IAM principals with permission to the Amazon S3 `GetObject` action for the query +###### Note + + * In the case of canceled or failed queries, Athena may have already written partial results to Amazon S3. In such cases, Athena does not delete partial results from the Amazon S3 prefix where results are stored. You must remove the Amazon S3 prefix with partial results. Athena uses Amazon S3 multipart uploads to write data Amazon S3. We recommend that you set the bucket lifecycle policy to end multipart uploads in cases when queries fail. For more information, see [Aborting incomplete multipart uploads using a bucket lifecycle policy](https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config) in the _Amazon Simple Storage Service User Guide_. + + * Under certain conditions, Athena may automatically retry query executions. In most cases, these queries are able to complete successfully and the query ID is marked as `Completed`. These queries might have written partial results during the initial attempts and may generate incomplete multipart uploads. + + + +