fix(stepfunctions-tasks): encryption is required for AthenaStartQueryExecution

packages/@aws-cdk/aws-stepfunctions-tasks/lib/athena/start-query-execution.ts

@@ -167,6 +167,17 @@ export class AthenaStartQueryExecution extends sfn.TaskStateBase {
     return policyStatements;
   }
 
+  private renderEncryption(): any {
+    const encryptionConfiguration = this.props.resultConfiguration?.encryptionConfiguration !== undefined
+      ? {
+        EncryptionOption: this.props.resultConfiguration.encryptionConfiguration.encryptionOption,
+        KmsKey: this.props.resultConfiguration.encryptionConfiguration.encryptionKey,
+      }
+      : undefined;
+
+    return encryptionConfiguration;
+  }
+
   /**
    * Provides the Athena start query execution service integration task configuration
    */
@@ -185,10 +196,7 @@ export class AthenaStartQueryExecution extends sfn.TaskStateBase {
             Database: this.props.queryExecutionContext?.databaseName,
           },
           ResultConfiguration: {
-            EncryptionConfiguration: {
-              EncryptionOption: this.props.resultConfiguration?.encryptionConfiguration?.encryptionOption,
-              KmsKey: this.props.resultConfiguration?.encryptionConfiguration?.encryptionKey,
-            },
+            EncryptionConfiguration: this.renderEncryption(),
             OutputLocation: `s3://${this.props.resultConfiguration?.outputLocation?.bucketName}/${this.props.resultConfiguration?.outputLocation?.objectKey}/`,
           },
           WorkGroup: this.props.workGroup,
@@ -205,10 +213,7 @@ export class AthenaStartQueryExecution extends sfn.TaskStateBase {
             Database: this.props.queryExecutionContext?.databaseName,
           },
           ResultConfiguration: {
-            EncryptionConfiguration: {
-              EncryptionOption: this.props.resultConfiguration?.encryptionConfiguration?.encryptionOption,
-              KmsKey: this.props.resultConfiguration?.encryptionConfiguration?.encryptionKey,
-            },
+            EncryptionConfiguration: this.renderEncryption(),
           },
           WorkGroup: this.props.workGroup,
         }),

packages/@aws-cdk/aws-stepfunctions-tasks/test/athena/start-query-execution.test.ts

@@ -101,4 +101,56 @@ describe('Start Query Execution', () => {
       },
     });
   });
+
+  test('no encryptionConfiguration', () => {
+    // GIVEN
+    const stack = new cdk.Stack();
+
+    // WHEN
+    const task = new AthenaStartQueryExecution(stack, 'Query', {
+      queryString: 'CREATE DATABASE database',
+      clientRequestToken: 'unique-client-request-token',
+      queryExecutionContext: {
+        databaseName: 'mydatabase',
+        catalogName: 'AwsDataCatalog',
+      },
+      resultConfiguration: {
+        outputLocation: {
+          bucketName: 'query-results-bucket',
+          objectKey: 'folder',
+        },
+      },
+      workGroup: 'primary',
+    });
+
+    // THEN
+    expect(stack.resolve(task.toStateJson())).toEqual({
+      Type: 'Task',
+      Resource: {
+        'Fn::Join': [
+          '',
+          [
+            'arn:',
+            {
+              Ref: 'AWS::Partition',
+            },
+            ':states:::athena:startQueryExecution',
+          ],
+        ],
+      },
+      End: true,
+      Parameters: {
+        QueryString: 'CREATE DATABASE database',
+        ClientRequestToken: 'unique-client-request-token',
+        QueryExecutionContext: {
+          Database: 'mydatabase',
+          Catalog: 'AwsDataCatalog',
+        },
+        ResultConfiguration: {
+          OutputLocation: 's3://query-results-bucket/folder/',
+        },
+        WorkGroup: 'primary',
+      },
+    });
+  });
 });