Pyathena encryption with kms key is not working about pyathena HOT 7 CLOSED

This following code is working for me

client = boto3.client('athena')
response = client.start_query_execution(
    QueryString=sql_query,
    QueryExecutionContext={
        'Database': database
    },
    ResultConfiguration={
        'OutputLocation': s3_staging_dir,
        'EncryptionConfiguration': {
            'EncryptionOption': 'SSE_KMS',
            'KmsKey': kms_key_arn
        }
    }
)

from pyathena.

https://docs.aws.amazon.com/athena/latest/ug/encryption.html

You can run queries in Athena to query encrypted data in Amazon S3 by indicating data encryption when you create a table.

It is not an option to encrypt the query result output to s3_staging_dir.

from pyathena.

https://docs.aws.amazon.com/athena/latest/ug/encryption.html#encrypting-query-results-stored-in-s3
https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html
I think that this is the encryption setting of the query result.

from pyathena.

Thank you for the reply. I am looking for the Client-side settings. Since we are passing query results location from the client and we should be able to provide encryption also.

Client-side settings. When you use Settings in the console or the API operations to indicate that you want to encrypt query results, this is known as using client-side settings. Client-side settings include query results location and encryption. If you specify them, they are used, unless they are overridden by the workgroup settings.

Since we are passing query results location (s3_staging_dir) from the client and we should be able to send encryption also.

I have data in S3 encrypted with specific KMS, but i am able to query without passing kms_key encryption_option.

from pyathena.

It is okay. I will investigate.

from pyathena.

Is it possible to encrypt the query results when using Boto3?
https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/athena.html
If you seem to be able to do it, please share that sample code.

from pyathena.

It is working as expected with PyAthena also.

connection = connect(
    s3_staging_dir='s3://' + athena_results_s3_bucket + '/athena_results',
    region_name=region,
    encryption_option='SSE_KMS',
    kms_key=kms_key
)
cursor = connection.cursor()
cursor.execute(sql_query)

But the results inside s3_staging_dir is not encrypted (With PyAthena and boto3) . But it is actualy encrypted at s3://aws-athena-query-results-<account_id>-<region>/Unsaved/2019/02/28/0a7d28b4-d785-41e7-b0bd-40fc5a87c05e.csv

Is there any way to encrypt this as well?

boto3 issue reference

from pyathena.