aws-cdk-lib 2.200.2__py3-none-any.whl → 2.224.0__py3-none-any.whl

aws_cdk/aws_athena/__init__.py

@@ -68,9 +68,21 @@ from .. import (
     TagManager as _TagManager_0a598cb3,
     TreeInspector as _TreeInspector_488e0dd5,
 )
+from ..interfaces.aws_athena import (
+    CapacityReservationReference as _CapacityReservationReference_b0153440,
+    DataCatalogReference as _DataCatalogReference_623bd693,
+    ICapacityReservationRef as _ICapacityReservationRef_b5ac8483,
+    IDataCatalogRef as _IDataCatalogRef_a1e1d9b1,
+    INamedQueryRef as _INamedQueryRef_a21e9848,
+    IPreparedStatementRef as _IPreparedStatementRef_12e21245,
+    IWorkGroupRef as _IWorkGroupRef_ee1f32da,
+    NamedQueryReference as _NamedQueryReference_fe58156f,
+    PreparedStatementReference as _PreparedStatementReference_7194fb5a,
+    WorkGroupReference as _WorkGroupReference_21c92b3e,
+)
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _ICapacityReservationRef_b5ac8483, _ITaggableV2_4e6798f8)
 class CfnCapacityReservation(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -115,7 +127,8 @@ class CfnCapacityReservation(
         capacity_assignment_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnCapacityReservation.CapacityAssignmentConfigurationProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Athena::CapacityReservation``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param name: The name of the capacity reservation.
@@ -211,6 +224,12 @@ class CfnCapacityReservation(
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrStatus"))
 
+    @builtins.property
+    @jsii.member(jsii_name="capacityReservationRef")
+    def capacity_reservation_ref(self) -> _CapacityReservationReference_b0153440:
+        '''A reference to a CapacityReservation resource.'''
+        return typing.cast(_CapacityReservationReference_b0153440, jsii.get(self, "capacityReservationRef"))
+
     @builtins.property
     @jsii.member(jsii_name="cdkTagManager")
     def cdk_tag_manager(self) -> _TagManager_0a598cb3:
@@ -516,7 +535,7 @@ class CfnCapacityReservationProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IDataCatalogRef_a1e1d9b1, _ITaggable_36806126)
 class CfnDataCatalog(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -569,7 +588,8 @@ class CfnDataCatalog(
         status: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Athena::DataCatalog``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param name: The name of the data catalog. The catalog name must be unique for the AWS account and can use a maximum of 128 alphanumeric, underscore, at sign, or hyphen characters.
@@ -577,7 +597,7 @@ class CfnDataCatalog(
         :param connection_type: The type of connection for a ``FEDERATED`` data catalog (for example, ``REDSHIFT`` , ``MYSQL`` , or ``SQLSERVER`` ). For information about individual connectors, see `Available data source connectors <https://docs.aws.amazon.com/athena/latest/ug/connectors-available.html>`_ .
         :param description: A description of the data catalog.
         :param error: Text of the error that occurred during data catalog creation or deletion.
-        :param parameters: Specifies the Lambda function or functions to use for the data catalog. The mapping used depends on the catalog type. - The ``HIVE`` data catalog type uses the following syntax. The ``metadata-function`` parameter is required. ``The sdk-version`` parameter is optional and defaults to the currently supported version. ``metadata-function= *lambda_arn* , sdk-version= *version_number*`` - The ``LAMBDA`` data catalog type uses one of the following sets of required parameters, but not both. - When one Lambda function processes metadata and another Lambda function reads data, the following syntax is used. Both parameters are required. ``metadata-function= *lambda_arn* , record-function= *lambda_arn*`` - A composite Lambda function that processes both metadata and data uses the following syntax. ``function= *lambda_arn*`` - The ``GLUE`` type takes a catalog ID parameter and is required. The ``*catalog_id*`` is the account ID of the AWS account to which the Glue catalog belongs. ``catalog-id= *catalog_id*`` - The ``GLUE`` data catalog type also applies to the default ``AwsDataCatalog`` that already exists in your account, of which you can have only one and cannot modify.
+        :param parameters: Specifies the Lambda function or functions to use for creating the data catalog. This is a mapping whose values depend on the catalog type. - For the ``HIVE`` data catalog type, use the following syntax. The ``metadata-function`` parameter is required. ``The sdk-version`` parameter is optional and defaults to the currently supported version. ``metadata-function= *lambda_arn* , sdk-version= *version_number*`` - For the ``LAMBDA`` data catalog type, use one of the following sets of required parameters, but not both. - If you have one Lambda function that processes metadata and another for reading the actual data, use the following syntax. Both parameters are required. ``metadata-function= *lambda_arn* , record-function= *lambda_arn*`` - If you have a composite Lambda function that processes both metadata and data, use the following syntax to specify your Lambda function. ``function= *lambda_arn*`` - The ``GLUE`` type takes a catalog ID parameter and is required. The ``*catalog_id*`` is the account ID of the AWS account to which the AWS Glue Data Catalog belongs. ``catalog-id= *catalog_id*`` - The ``GLUE`` data catalog type also applies to the default ``AwsDataCatalog`` that already exists in your account, of which you can have only one and cannot modify. - The ``FEDERATED`` data catalog type uses one of the following parameters, but not both. Use ``connection-arn`` for an existing AWS Glue connection. Use ``connection-type`` and ``connection-properties`` to specify the configuration setting for a new connection. - ``connection-arn: *<glue_connection_arn_to_reuse>*`` - ``lambda-role-arn`` (optional): The execution role to use for the Lambda function. If not provided, one is created. - ``connection-type:MYSQL|REDSHIFT|...., connection-properties:" *<json_string>* "`` For *``<json_string>``* , use escaped JSON text, as in the following example. ``"{\\"spill_bucket\\":\\"my_spill\\",\\"spill_prefix\\":\\"athena-spill\\",\\"host\\":\\"abc12345.snowflakecomputing.com\\",\\"port\\":\\"1234\\",\\"warehouse\\":\\"DEV_WH\\",\\"database\\":\\"TEST\\",\\"schema\\":\\"PUBLIC\\",\\"SecretArn\\":\\"arn:aws:secretsmanager:ap-south-1:111122223333:secret:snowflake-XHb67j\\"}"``
         :param status: The status of the creation or deletion of the data catalog. - The ``LAMBDA`` , ``GLUE`` , and ``HIVE`` data catalog types are created synchronously. Their status is either ``CREATE_COMPLETE`` or ``CREATE_FAILED`` . - The ``FEDERATED`` data catalog type is created asynchronously. Data catalog creation status: - ``CREATE_IN_PROGRESS`` : Federated data catalog creation in progress. - ``CREATE_COMPLETE`` : Data catalog creation complete. - ``CREATE_FAILED`` : Data catalog could not be created. - ``CREATE_FAILED_CLEANUP_IN_PROGRESS`` : Federated data catalog creation failed and is being removed. - ``CREATE_FAILED_CLEANUP_COMPLETE`` : Federated data catalog creation failed and was removed. - ``CREATE_FAILED_CLEANUP_FAILED`` : Federated data catalog creation failed but could not be removed. Data catalog deletion status: - ``DELETE_IN_PROGRESS`` : Federated data catalog deletion in progress. - ``DELETE_COMPLETE`` : Federated data catalog deleted. - ``DELETE_FAILED`` : Federated data catalog could not be deleted.
         :param tags: The tags (key-value pairs) to associate with this resource.
         '''
@@ -598,6 +618,27 @@ class CfnDataCatalog(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromDataCatalogName")
+    @builtins.classmethod
+    def from_data_catalog_name(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        data_catalog_name: builtins.str,
+    ) -> _IDataCatalogRef_a1e1d9b1:
+        '''Creates a new IDataCatalogRef from a dataCatalogName.
+
+        :param scope: -
+        :param id: -
+        :param data_catalog_name: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__d5d2a0246fafbbc6a693f337ada29b85155f59962e79d7c642084d44652d0f2e)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument data_catalog_name", value=data_catalog_name, expected_type=type_hints["data_catalog_name"])
+        return typing.cast(_IDataCatalogRef_a1e1d9b1, jsii.sinvoke(cls, "fromDataCatalogName", [scope, id, data_catalog_name]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -633,6 +674,12 @@ class CfnDataCatalog(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="dataCatalogRef")
+    def data_catalog_ref(self) -> _DataCatalogReference_623bd693:
+        '''A reference to a DataCatalog resource.'''
+        return typing.cast(_DataCatalogReference_623bd693, jsii.get(self, "dataCatalogRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -709,7 +756,7 @@ class CfnDataCatalog(
     def parameters(
         self,
     ) -> typing.Optional[typing.Union[typing.Mapping[builtins.str, builtins.str], _IResolvable_da3f097b]]:
-        '''Specifies the Lambda function or functions to use for the data catalog.'''
+        '''Specifies the Lambda function or functions to use for creating the data catalog.'''
         return typing.cast(typing.Optional[typing.Union[typing.Mapping[builtins.str, builtins.str], _IResolvable_da3f097b]], jsii.get(self, "parameters"))
 
     @parameters.setter
@@ -783,7 +830,7 @@ class CfnDataCatalogProps:
         :param connection_type: The type of connection for a ``FEDERATED`` data catalog (for example, ``REDSHIFT`` , ``MYSQL`` , or ``SQLSERVER`` ). For information about individual connectors, see `Available data source connectors <https://docs.aws.amazon.com/athena/latest/ug/connectors-available.html>`_ .
         :param description: A description of the data catalog.
         :param error: Text of the error that occurred during data catalog creation or deletion.
-        :param parameters: Specifies the Lambda function or functions to use for the data catalog. The mapping used depends on the catalog type. - The ``HIVE`` data catalog type uses the following syntax. The ``metadata-function`` parameter is required. ``The sdk-version`` parameter is optional and defaults to the currently supported version. ``metadata-function= *lambda_arn* , sdk-version= *version_number*`` - The ``LAMBDA`` data catalog type uses one of the following sets of required parameters, but not both. - When one Lambda function processes metadata and another Lambda function reads data, the following syntax is used. Both parameters are required. ``metadata-function= *lambda_arn* , record-function= *lambda_arn*`` - A composite Lambda function that processes both metadata and data uses the following syntax. ``function= *lambda_arn*`` - The ``GLUE`` type takes a catalog ID parameter and is required. The ``*catalog_id*`` is the account ID of the AWS account to which the Glue catalog belongs. ``catalog-id= *catalog_id*`` - The ``GLUE`` data catalog type also applies to the default ``AwsDataCatalog`` that already exists in your account, of which you can have only one and cannot modify.
+        :param parameters: Specifies the Lambda function or functions to use for creating the data catalog. This is a mapping whose values depend on the catalog type. - For the ``HIVE`` data catalog type, use the following syntax. The ``metadata-function`` parameter is required. ``The sdk-version`` parameter is optional and defaults to the currently supported version. ``metadata-function= *lambda_arn* , sdk-version= *version_number*`` - For the ``LAMBDA`` data catalog type, use one of the following sets of required parameters, but not both. - If you have one Lambda function that processes metadata and another for reading the actual data, use the following syntax. Both parameters are required. ``metadata-function= *lambda_arn* , record-function= *lambda_arn*`` - If you have a composite Lambda function that processes both metadata and data, use the following syntax to specify your Lambda function. ``function= *lambda_arn*`` - The ``GLUE`` type takes a catalog ID parameter and is required. The ``*catalog_id*`` is the account ID of the AWS account to which the AWS Glue Data Catalog belongs. ``catalog-id= *catalog_id*`` - The ``GLUE`` data catalog type also applies to the default ``AwsDataCatalog`` that already exists in your account, of which you can have only one and cannot modify. - The ``FEDERATED`` data catalog type uses one of the following parameters, but not both. Use ``connection-arn`` for an existing AWS Glue connection. Use ``connection-type`` and ``connection-properties`` to specify the configuration setting for a new connection. - ``connection-arn: *<glue_connection_arn_to_reuse>*`` - ``lambda-role-arn`` (optional): The execution role to use for the Lambda function. If not provided, one is created. - ``connection-type:MYSQL|REDSHIFT|...., connection-properties:" *<json_string>* "`` For *``<json_string>``* , use escaped JSON text, as in the following example. ``"{\\"spill_bucket\\":\\"my_spill\\",\\"spill_prefix\\":\\"athena-spill\\",\\"host\\":\\"abc12345.snowflakecomputing.com\\",\\"port\\":\\"1234\\",\\"warehouse\\":\\"DEV_WH\\",\\"database\\":\\"TEST\\",\\"schema\\":\\"PUBLIC\\",\\"SecretArn\\":\\"arn:aws:secretsmanager:ap-south-1:111122223333:secret:snowflake-XHb67j\\"}"``
         :param status: The status of the creation or deletion of the data catalog. - The ``LAMBDA`` , ``GLUE`` , and ``HIVE`` data catalog types are created synchronously. Their status is either ``CREATE_COMPLETE`` or ``CREATE_FAILED`` . - The ``FEDERATED`` data catalog type is created asynchronously. Data catalog creation status: - ``CREATE_IN_PROGRESS`` : Federated data catalog creation in progress. - ``CREATE_COMPLETE`` : Data catalog creation complete. - ``CREATE_FAILED`` : Data catalog could not be created. - ``CREATE_FAILED_CLEANUP_IN_PROGRESS`` : Federated data catalog creation failed and is being removed. - ``CREATE_FAILED_CLEANUP_COMPLETE`` : Federated data catalog creation failed and was removed. - ``CREATE_FAILED_CLEANUP_FAILED`` : Federated data catalog creation failed but could not be removed. Data catalog deletion status: - ``DELETE_IN_PROGRESS`` : Federated data catalog deletion in progress. - ``DELETE_COMPLETE`` : Federated data catalog deleted. - ``DELETE_FAILED`` : Federated data catalog could not be deleted.
         :param tags: The tags (key-value pairs) to associate with this resource.
 
@@ -896,28 +943,36 @@ class CfnDataCatalogProps:
     def parameters(
         self,
     ) -> typing.Optional[typing.Union[typing.Mapping[builtins.str, builtins.str], _IResolvable_da3f097b]]:
-        '''Specifies the Lambda function or functions to use for the data catalog.
+        '''Specifies the Lambda function or functions to use for creating the data catalog.
 
-        The mapping used depends on the catalog type.
+        This is a mapping whose values depend on the catalog type.
 
-        - The ``HIVE`` data catalog type uses the following syntax. The ``metadata-function`` parameter is required. ``The sdk-version`` parameter is optional and defaults to the currently supported version.
+        - For the ``HIVE`` data catalog type, use the following syntax. The ``metadata-function`` parameter is required. ``The sdk-version`` parameter is optional and defaults to the currently supported version.
 
         ``metadata-function= *lambda_arn* , sdk-version= *version_number*``
 
-        - The ``LAMBDA`` data catalog type uses one of the following sets of required parameters, but not both.
-        - When one Lambda function processes metadata and another Lambda function reads data, the following syntax is used. Both parameters are required.
+        - For the ``LAMBDA`` data catalog type, use one of the following sets of required parameters, but not both.
+        - If you have one Lambda function that processes metadata and another for reading the actual data, use the following syntax. Both parameters are required.
 
         ``metadata-function= *lambda_arn* , record-function= *lambda_arn*``
 
-        - A composite Lambda function that processes both metadata and data uses the following syntax.
+        - If you have a composite Lambda function that processes both metadata and data, use the following syntax to specify your Lambda function.
 
         ``function= *lambda_arn*``
 
-        - The ``GLUE`` type takes a catalog ID parameter and is required. The ``*catalog_id*`` is the account ID of the AWS account to which the Glue catalog belongs.
+        - The ``GLUE`` type takes a catalog ID parameter and is required. The ``*catalog_id*`` is the account ID of the AWS account to which the AWS Glue Data Catalog belongs.
 
         ``catalog-id= *catalog_id*``
 
         - The ``GLUE`` data catalog type also applies to the default ``AwsDataCatalog`` that already exists in your account, of which you can have only one and cannot modify.
+        - The ``FEDERATED`` data catalog type uses one of the following parameters, but not both. Use ``connection-arn`` for an existing AWS Glue connection. Use ``connection-type`` and ``connection-properties`` to specify the configuration setting for a new connection.
+        - ``connection-arn: *<glue_connection_arn_to_reuse>*``
+        - ``lambda-role-arn`` (optional): The execution role to use for the Lambda function. If not provided, one is created.
+        - ``connection-type:MYSQL|REDSHIFT|...., connection-properties:" *<json_string>* "``
+
+        For *``<json_string>``* , use escaped JSON text, as in the following example.
+
+        ``"{\\"spill_bucket\\":\\"my_spill\\",\\"spill_prefix\\":\\"athena-spill\\",\\"host\\":\\"abc12345.snowflakecomputing.com\\",\\"port\\":\\"1234\\",\\"warehouse\\":\\"DEV_WH\\",\\"database\\":\\"TEST\\",\\"schema\\":\\"PUBLIC\\",\\"SecretArn\\":\\"arn:aws:secretsmanager:ap-south-1:111122223333:secret:snowflake-XHb67j\\"}"``
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-athena-datacatalog.html#cfn-athena-datacatalog-parameters
         '''
@@ -972,7 +1027,7 @@ class CfnDataCatalogProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _INamedQueryRef_a21e9848)
 class CfnNamedQuery(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1012,7 +1067,8 @@ class CfnNamedQuery(
         name: typing.Optional[builtins.str] = None,
         work_group: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Athena::NamedQuery``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param database: The database to which the query belongs.
@@ -1079,6 +1135,12 @@ class CfnNamedQuery(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="namedQueryRef")
+    def named_query_ref(self) -> _NamedQueryReference_fe58156f:
+        '''A reference to a NamedQuery resource.'''
+        return typing.cast(_NamedQueryReference_fe58156f, jsii.get(self, "namedQueryRef"))
+
     @builtins.property
     @jsii.member(jsii_name="database")
     def database(self) -> builtins.str:
@@ -1270,7 +1332,7 @@ class CfnNamedQueryProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IPreparedStatementRef_12e21245)
 class CfnPreparedStatement(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1308,7 +1370,8 @@ class CfnPreparedStatement(
         work_group: builtins.str,
         description: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Athena::PreparedStatement``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param query_statement: The query string for the prepared statement.
@@ -1364,6 +1427,12 @@ class CfnPreparedStatement(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="preparedStatementRef")
+    def prepared_statement_ref(self) -> _PreparedStatementReference_7194fb5a:
+        '''A reference to a PreparedStatement resource.'''
+        return typing.cast(_PreparedStatementReference_7194fb5a, jsii.get(self, "preparedStatementRef"))
+
     @builtins.property
     @jsii.member(jsii_name="queryStatement")
     def query_statement(self) -> builtins.str:
@@ -1526,7 +1595,7 @@ class CfnPreparedStatementProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IWorkGroupRef_ee1f32da, _ITaggable_36806126)
 class CfnWorkGroup(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1569,6 +1638,12 @@ class CfnWorkGroup(
                     selected_engine_version="selectedEngineVersion"
                 ),
                 execution_role="executionRole",
+                managed_query_results_configuration=athena.CfnWorkGroup.ManagedQueryResultsConfigurationProperty(
+                    enabled=False,
+                    encryption_configuration=athena.CfnWorkGroup.ManagedStorageEncryptionConfigurationProperty(
+                        kms_key="kmsKey"
+                    )
+                ),
                 publish_cloud_watch_metrics_enabled=False,
                 requester_pays_enabled=False,
                 result_configuration=athena.CfnWorkGroup.ResultConfigurationProperty(
@@ -1597,6 +1672,12 @@ class CfnWorkGroup(
                     selected_engine_version="selectedEngineVersion"
                 ),
                 execution_role="executionRole",
+                managed_query_results_configuration=athena.CfnWorkGroup.ManagedQueryResultsConfigurationProperty(
+                    enabled=False,
+                    encryption_configuration=athena.CfnWorkGroup.ManagedStorageEncryptionConfigurationProperty(
+                        kms_key="kmsKey"
+                    )
+                ),
                 publish_cloud_watch_metrics_enabled=False,
                 remove_bytes_scanned_cutoff_per_query=False,
                 remove_customer_content_encryption_configuration=False,
@@ -1635,7 +1716,8 @@ class CfnWorkGroup(
         work_group_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWorkGroup.WorkGroupConfigurationProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         work_group_configuration_updates: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWorkGroup.WorkGroupConfigurationUpdatesProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Athena::WorkGroup``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param name: The workgroup name.
@@ -1662,6 +1744,27 @@ class CfnWorkGroup(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromWorkGroupName")
+    @builtins.classmethod
+    def from_work_group_name(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        work_group_name: builtins.str,
+    ) -> _IWorkGroupRef_ee1f32da:
+        '''Creates a new IWorkGroupRef from a workGroupName.
+
+        :param scope: -
+        :param id: -
+        :param work_group_name: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__be43a8d87adff5435c9f23ab60a2b7d950366fdde534d2500f7e413d6b588f9f)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument work_group_name", value=work_group_name, expected_type=type_hints["work_group_name"])
+        return typing.cast(_IWorkGroupRef_ee1f32da, jsii.sinvoke(cls, "fromWorkGroupName", [scope, id, work_group_name]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -1740,6 +1843,12 @@ class CfnWorkGroup(
         '''Tag Manager which manages the tags for this resource.'''
         return typing.cast(_TagManager_0a598cb3, jsii.get(self, "tags"))
 
+    @builtins.property
+    @jsii.member(jsii_name="workGroupRef")
+    def work_group_ref(self) -> _WorkGroupReference_21c92b3e:
+        '''A reference to a WorkGroup resource.'''
+        return typing.cast(_WorkGroupReference_21c92b3e, jsii.get(self, "workGroupRef"))
+
     @builtins.property
     @jsii.member(jsii_name="name")
     def name(self) -> builtins.str:
@@ -2113,6 +2222,142 @@ class CfnWorkGroup(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_athena.CfnWorkGroup.ManagedQueryResultsConfigurationProperty",
+        jsii_struct_bases=[],
+        name_mapping={
+            "enabled": "enabled",
+            "encryption_configuration": "encryptionConfiguration",
+        },
+    )
+    class ManagedQueryResultsConfigurationProperty:
+        def __init__(
+            self,
+            *,
+            enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+            encryption_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWorkGroup.ManagedStorageEncryptionConfigurationProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+        ) -> None:
+            '''The configuration for storing results in Athena owned storage, which includes whether this feature is enabled;
+
+            whether encryption configuration, if any, is used for encrypting query results.
+
+            :param enabled: If set to true, allows you to store query results in Athena owned storage. If set to false, workgroup member stores query results in location specified under ``ResultConfiguration$OutputLocation`` . The default is false. A workgroup cannot have the ``ResultConfiguration$OutputLocation`` parameter when you set this field to true.
+            :param encryption_configuration: If you encrypt query and calculation results in Athena owned storage, this field indicates the encryption option (for example, SSE_KMS or CSE_KMS) and key information.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-athena-workgroup-managedqueryresultsconfiguration.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_athena as athena
+                
+                managed_query_results_configuration_property = athena.CfnWorkGroup.ManagedQueryResultsConfigurationProperty(
+                    enabled=False,
+                    encryption_configuration=athena.CfnWorkGroup.ManagedStorageEncryptionConfigurationProperty(
+                        kms_key="kmsKey"
+                    )
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__f6c4d2e9be468cb69e158be7cc0f67bd537760da2f65bdfea130a3adceb65198)
+                check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
+                check_type(argname="argument encryption_configuration", value=encryption_configuration, expected_type=type_hints["encryption_configuration"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if enabled is not None:
+                self._values["enabled"] = enabled
+            if encryption_configuration is not None:
+                self._values["encryption_configuration"] = encryption_configuration
+
+        @builtins.property
+        def enabled(
+            self,
+        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
+            '''If set to true, allows you to store query results in Athena owned storage.
+
+            If set to false, workgroup member stores query results in location specified under ``ResultConfiguration$OutputLocation`` . The default is false. A workgroup cannot have the ``ResultConfiguration$OutputLocation`` parameter when you set this field to true.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-athena-workgroup-managedqueryresultsconfiguration.html#cfn-athena-workgroup-managedqueryresultsconfiguration-enabled
+            '''
+            result = self._values.get("enabled")
+            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)
+
+        @builtins.property
+        def encryption_configuration(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnWorkGroup.ManagedStorageEncryptionConfigurationProperty"]]:
+            '''If you encrypt query and calculation results in Athena owned storage, this field indicates the encryption option (for example, SSE_KMS or CSE_KMS) and key information.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-athena-workgroup-managedqueryresultsconfiguration.html#cfn-athena-workgroup-managedqueryresultsconfiguration-encryptionconfiguration
+            '''
+            result = self._values.get("encryption_configuration")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnWorkGroup.ManagedStorageEncryptionConfigurationProperty"]], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "ManagedQueryResultsConfigurationProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_athena.CfnWorkGroup.ManagedStorageEncryptionConfigurationProperty",
+        jsii_struct_bases=[],
+        name_mapping={"kms_key": "kmsKey"},
+    )
+    class ManagedStorageEncryptionConfigurationProperty:
+        def __init__(self, *, kms_key: typing.Optional[builtins.str] = None) -> None:
+            '''Indicates the encryption configuration for Athena Managed Storage.
+
+            If not setting this field, Managed Storage will encrypt the query results with Athena's encryption key
+
+            :param kms_key: For SSE-KMS and CSE-KMS, this is the KMS key ARN or ID.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-athena-workgroup-managedstorageencryptionconfiguration.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_athena as athena
+                
+                managed_storage_encryption_configuration_property = athena.CfnWorkGroup.ManagedStorageEncryptionConfigurationProperty(
+                    kms_key="kmsKey"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__53549459074bb1d23e4ee2a6fd045c500008070dfc2015833edc260380222a02)
+                check_type(argname="argument kms_key", value=kms_key, expected_type=type_hints["kms_key"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if kms_key is not None:
+                self._values["kms_key"] = kms_key
+
+        @builtins.property
+        def kms_key(self) -> typing.Optional[builtins.str]:
+            '''For SSE-KMS and CSE-KMS, this is the KMS key ARN or ID.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-athena-workgroup-managedstorageencryptionconfiguration.html#cfn-athena-workgroup-managedstorageencryptionconfiguration-kmskey
+            '''
+            result = self._values.get("kms_key")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "ManagedStorageEncryptionConfigurationProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_athena.CfnWorkGroup.ResultConfigurationProperty",
         jsii_struct_bases=[],
@@ -2272,11 +2517,11 @@ class CfnWorkGroup(
 
             :param acl_configuration: The ACL configuration for the query results.
             :param encryption_configuration: The encryption configuration for the query results.
-            :param expected_bucket_owner: The AWS account ID that you expect to be the owner of the Amazon S3 bucket specified by ``ResultConfiguration$OutputLocation`` . If set, Athena uses the value for ``ExpectedBucketOwner`` when it makes Amazon S3 calls to your specified output location. If the ``ExpectedBucketOwner`` AWS account ID does not match the actual owner of the Amazon S3 bucket, the call fails with a permissions error. If workgroup settings override client-side settings, then the query uses the ``ExpectedBucketOwner`` setting that is specified for the workgroup, and also uses the location for storing query results specified in the workgroup. See ``WorkGroupConfiguration$EnforceWorkGroupConfiguration`` and `Workgroup Settings Override Client-Side Settings <https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html>`_ .
+            :param expected_bucket_owner: The AWS account ID that you expect to be the owner of the Amazon S3 bucket specified by ` <https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-athena-workgroup-resultconfiguration.html#cfn-athena-workgroup-resultconfiguration-outputlocation>`_ . If set, Athena uses the value for ``ExpectedBucketOwner`` when it makes Amazon S3 calls to your specified output location. If the ``ExpectedBucketOwner`` AWS account ID does not match the actual owner of the Amazon S3 bucket, the call fails with a permissions error. If workgroup settings override client-side settings, then the query uses the ``ExpectedBucketOwner`` setting that is specified for the workgroup, and also uses the location for storing query results specified in the workgroup. See ` <https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-athena-workgroup-workgroupconfiguration.html#cfn-athena-workgroup-workgroupconfiguration-enforceworkgroupconfiguration>`_ and `Workgroup Settings Override Client-Side Settings <https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html>`_ .
             :param output_location: The location in Amazon S3 where your query results are stored, such as ``s3://path/to/query/bucket/`` . For more information, see `Query Results <https://docs.aws.amazon.com/athena/latest/ug/querying.html>`_ If workgroup settings override client-side settings, then the query uses the location for the query results and the encryption configuration that are specified for the workgroup. The "workgroup settings override" is specified in EnforceWorkGroupConfiguration (true/false) in the WorkGroupConfiguration. See ``EnforceWorkGroupConfiguration`` .
             :param remove_acl_configuration: If set to ``true`` , indicates that the previously-specified ACL configuration for queries in this workgroup should be ignored and set to null. If set to ``false`` or not set, and a value is present in the ``AclConfiguration`` of ``ResultConfigurationUpdates`` , the ``AclConfiguration`` in the workgroup's ``ResultConfiguration`` is updated with the new value. For more information, see `Workgroup Settings Override Client-Side Settings <https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html>`_ .
             :param remove_encryption_configuration: If set to "true", indicates that the previously-specified encryption configuration (also known as the client-side setting) for queries in this workgroup should be ignored and set to null. If set to "false" or not set, and a value is present in the EncryptionConfiguration in ResultConfigurationUpdates (the client-side setting), the EncryptionConfiguration in the workgroup's ResultConfiguration will be updated with the new value. For more information, see `Override Client-Side Settings <https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html>`_ .
-            :param remove_expected_bucket_owner: If set to "true", removes the AWS account ID previously specified for ``ResultConfiguration$ExpectedBucketOwner`` . If set to "false" or not set, and a value is present in the ``ExpectedBucketOwner`` in ``ResultConfigurationUpdates`` (the client-side setting), the ``ExpectedBucketOwner`` in the workgroup's ``ResultConfiguration`` is updated with the new value. For more information, see `Workgroup Settings Override Client-Side Settings <https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html>`_ .
+            :param remove_expected_bucket_owner: If set to "true", removes the AWS account ID previously specified for ` <https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-athena-workgroup-resultconfiguration.html#cfn-athena-workgroup-resultconfiguration-expectedbucketowner>`_ . If set to "false" or not set, and a value is present in the ``ExpectedBucketOwner`` in ``ResultConfigurationUpdates`` (the client-side setting), the ``ExpectedBucketOwner`` in the workgroup's ``ResultConfiguration`` is updated with the new value. For more information, see `Workgroup Settings Override Client-Side Settings <https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html>`_ .
             :param remove_output_location: If set to "true", indicates that the previously-specified query results location (also known as a client-side setting) for queries in this workgroup should be ignored and set to null. If set to "false" or not set, and a value is present in the OutputLocation in ResultConfigurationUpdates (the client-side setting), the OutputLocation in the workgroup's ResultConfiguration will be updated with the new value. For more information, see `Override Client-Side Settings <https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html>`_ .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-athena-workgroup-resultconfigurationupdates.html
@@ -2358,11 +2603,9 @@ class CfnWorkGroup(
 
         @builtins.property
         def expected_bucket_owner(self) -> typing.Optional[builtins.str]:
-            '''The AWS account ID that you expect to be the owner of the Amazon S3 bucket specified by ``ResultConfiguration$OutputLocation`` .
-
-            If set, Athena uses the value for ``ExpectedBucketOwner`` when it makes Amazon S3 calls to your specified output location. If the ``ExpectedBucketOwner`` AWS account ID does not match the actual owner of the Amazon S3 bucket, the call fails with a permissions error.
+            '''The AWS account ID that you expect to be the owner of the Amazon S3 bucket specified by ` <https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-athena-workgroup-resultconfiguration.html#cfn-athena-workgroup-resultconfiguration-outputlocation>`_ . If set, Athena uses the value for ``ExpectedBucketOwner`` when it makes Amazon S3 calls to your specified output location. If the ``ExpectedBucketOwner`` AWS account ID does not match the actual owner of the Amazon S3 bucket, the call fails with a permissions error.
 
-            If workgroup settings override client-side settings, then the query uses the ``ExpectedBucketOwner`` setting that is specified for the workgroup, and also uses the location for storing query results specified in the workgroup. See ``WorkGroupConfiguration$EnforceWorkGroupConfiguration`` and `Workgroup Settings Override Client-Side Settings <https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html>`_ .
+            If workgroup settings override client-side settings, then the query uses the ``ExpectedBucketOwner`` setting that is specified for the workgroup, and also uses the location for storing query results specified in the workgroup. See ` <https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-athena-workgroup-workgroupconfiguration.html#cfn-athena-workgroup-workgroupconfiguration-enforceworkgroupconfiguration>`_ and `Workgroup Settings Override Client-Side Settings <https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html>`_ .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-athena-workgroup-resultconfigurationupdates.html#cfn-athena-workgroup-resultconfigurationupdates-expectedbucketowner
             '''
@@ -2410,9 +2653,7 @@ class CfnWorkGroup(
         def remove_expected_bucket_owner(
             self,
         ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
-            '''If set to "true", removes the AWS account ID previously specified for ``ResultConfiguration$ExpectedBucketOwner`` .
-
-            If set to "false" or not set, and a value is present in the ``ExpectedBucketOwner`` in ``ResultConfigurationUpdates`` (the client-side setting), the ``ExpectedBucketOwner`` in the workgroup's ``ResultConfiguration`` is updated with the new value. For more information, see `Workgroup Settings Override Client-Side Settings <https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html>`_ .
+            '''If set to "true", removes the AWS account ID previously specified for ` <https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-athena-workgroup-resultconfiguration.html#cfn-athena-workgroup-resultconfiguration-expectedbucketowner>`_ . If set to "false" or not set, and a value is present in the ``ExpectedBucketOwner`` in ``ResultConfigurationUpdates`` (the client-side setting), the ``ExpectedBucketOwner`` in the workgroup's ``ResultConfiguration`` is updated with the new value. For more information, see `Workgroup Settings Override Client-Side Settings <https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html>`_ .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-athena-workgroup-resultconfigurationupdates.html#cfn-athena-workgroup-resultconfigurationupdates-removeexpectedbucketowner
             '''
@@ -2453,6 +2694,7 @@ class CfnWorkGroup(
             "enforce_work_group_configuration": "enforceWorkGroupConfiguration",
             "engine_version": "engineVersion",
             "execution_role": "executionRole",
+            "managed_query_results_configuration": "managedQueryResultsConfiguration",
             "publish_cloud_watch_metrics_enabled": "publishCloudWatchMetricsEnabled",
             "requester_pays_enabled": "requesterPaysEnabled",
             "result_configuration": "resultConfiguration",
@@ -2468,6 +2710,7 @@ class CfnWorkGroup(
             enforce_work_group_configuration: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
             engine_version: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWorkGroup.EngineVersionProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             execution_role: typing.Optional[builtins.str] = None,
+            managed_query_results_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWorkGroup.ManagedQueryResultsConfigurationProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             publish_cloud_watch_metrics_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
             requester_pays_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
             result_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWorkGroup.ResultConfigurationProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -2482,6 +2725,7 @@ class CfnWorkGroup(
             :param enforce_work_group_configuration: If set to "true", the settings for the workgroup override client-side settings. If set to "false", client-side settings are used. For more information, see `Override client-side settings <https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html>`_ .
             :param engine_version: The engine version that all queries running on the workgroup use.
             :param execution_role: Role used to access user resources in an Athena for Apache Spark session. This property applies only to Spark-enabled workgroups in Athena.
+            :param managed_query_results_configuration: The configuration for storing results in Athena owned storage, which includes whether this feature is enabled; whether encryption configuration, if any, is used for encrypting query results.
             :param publish_cloud_watch_metrics_enabled: Indicates that the Amazon CloudWatch metrics are enabled for the workgroup.
             :param requester_pays_enabled: If set to ``true`` , allows members assigned to a workgroup to reference Amazon S3 Requester Pays buckets in queries. If set to ``false`` , workgroup members cannot query data from Requester Pays buckets, and queries that retrieve data from Requester Pays buckets cause an error. The default is ``false`` . For more information about Requester Pays buckets, see `Requester Pays Buckets <https://docs.aws.amazon.com/AmazonS3/latest/dev/RequesterPaysBuckets.html>`_ in the *Amazon Simple Storage Service Developer Guide* .
             :param result_configuration: Specifies the location in Amazon S3 where query results are stored and the encryption option, if any, used for query results. For more information, see `Work with query results and recent queries <https://docs.aws.amazon.com/athena/latest/ug/querying.html>`_ .
@@ -2507,6 +2751,12 @@ class CfnWorkGroup(
                         selected_engine_version="selectedEngineVersion"
                     ),
                     execution_role="executionRole",
+                    managed_query_results_configuration=athena.CfnWorkGroup.ManagedQueryResultsConfigurationProperty(
+                        enabled=False,
+                        encryption_configuration=athena.CfnWorkGroup.ManagedStorageEncryptionConfigurationProperty(
+                            kms_key="kmsKey"
+                        )
+                    ),
                     publish_cloud_watch_metrics_enabled=False,
                     requester_pays_enabled=False,
                     result_configuration=athena.CfnWorkGroup.ResultConfigurationProperty(
@@ -2532,6 +2782,7 @@ class CfnWorkGroup(
                 check_type(argname="argument enforce_work_group_configuration", value=enforce_work_group_configuration, expected_type=type_hints["enforce_work_group_configuration"])
                 check_type(argname="argument engine_version", value=engine_version, expected_type=type_hints["engine_version"])
                 check_type(argname="argument execution_role", value=execution_role, expected_type=type_hints["execution_role"])
+                check_type(argname="argument managed_query_results_configuration", value=managed_query_results_configuration, expected_type=type_hints["managed_query_results_configuration"])
                 check_type(argname="argument publish_cloud_watch_metrics_enabled", value=publish_cloud_watch_metrics_enabled, expected_type=type_hints["publish_cloud_watch_metrics_enabled"])
                 check_type(argname="argument requester_pays_enabled", value=requester_pays_enabled, expected_type=type_hints["requester_pays_enabled"])
                 check_type(argname="argument result_configuration", value=result_configuration, expected_type=type_hints["result_configuration"])
@@ -2548,6 +2799,8 @@ class CfnWorkGroup(
                 self._values["engine_version"] = engine_version
             if execution_role is not None:
                 self._values["execution_role"] = execution_role
+            if managed_query_results_configuration is not None:
+                self._values["managed_query_results_configuration"] = managed_query_results_configuration
             if publish_cloud_watch_metrics_enabled is not None:
                 self._values["publish_cloud_watch_metrics_enabled"] = publish_cloud_watch_metrics_enabled
             if requester_pays_enabled is not None:
@@ -2626,6 +2879,19 @@ class CfnWorkGroup(
             result = self._values.get("execution_role")
             return typing.cast(typing.Optional[builtins.str], result)
 
+        @builtins.property
+        def managed_query_results_configuration(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnWorkGroup.ManagedQueryResultsConfigurationProperty"]]:
+            '''The configuration for storing results in Athena owned storage, which includes whether this feature is enabled;
+
+            whether encryption configuration, if any, is used for encrypting query results.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-athena-workgroup-workgroupconfiguration.html#cfn-athena-workgroup-workgroupconfiguration-managedqueryresultsconfiguration
+            '''
+            result = self._values.get("managed_query_results_configuration")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnWorkGroup.ManagedQueryResultsConfigurationProperty"]], result)
+
         @builtins.property
         def publish_cloud_watch_metrics_enabled(
             self,
@@ -2684,6 +2950,7 @@ class CfnWorkGroup(
             "enforce_work_group_configuration": "enforceWorkGroupConfiguration",
             "engine_version": "engineVersion",
             "execution_role": "executionRole",
+            "managed_query_results_configuration": "managedQueryResultsConfiguration",
             "publish_cloud_watch_metrics_enabled": "publishCloudWatchMetricsEnabled",
             "remove_bytes_scanned_cutoff_per_query": "removeBytesScannedCutoffPerQuery",
             "remove_customer_content_encryption_configuration": "removeCustomerContentEncryptionConfiguration",
@@ -2701,6 +2968,7 @@ class CfnWorkGroup(
             enforce_work_group_configuration: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
             engine_version: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWorkGroup.EngineVersionProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             execution_role: typing.Optional[builtins.str] = None,
+            managed_query_results_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWorkGroup.ManagedQueryResultsConfigurationProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             publish_cloud_watch_metrics_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
             remove_bytes_scanned_cutoff_per_query: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
             remove_customer_content_encryption_configuration: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
@@ -2715,6 +2983,7 @@ class CfnWorkGroup(
             :param enforce_work_group_configuration: If set to "true", the settings for the workgroup override client-side settings. If set to "false", client-side settings are used
             :param engine_version: The Athena engine version for running queries.
             :param execution_role: Execution Role ARN required to run Athena Spark Calculations.
+            :param managed_query_results_configuration: The configuration for the managed query results and encryption option. ResultConfiguration and ManagedQueryResultsConfiguration cannot be set at the same time
             :param publish_cloud_watch_metrics_enabled: Indicates that the Amazon CloudWatch metrics are enabled for the workgroup.
             :param remove_bytes_scanned_cutoff_per_query: Indicates that the data usage control limit per query is removed.
             :param remove_customer_content_encryption_configuration: 
@@ -2742,6 +3011,12 @@ class CfnWorkGroup(
                         selected_engine_version="selectedEngineVersion"
                     ),
                     execution_role="executionRole",
+                    managed_query_results_configuration=athena.CfnWorkGroup.ManagedQueryResultsConfigurationProperty(
+                        enabled=False,
+                        encryption_configuration=athena.CfnWorkGroup.ManagedStorageEncryptionConfigurationProperty(
+                            kms_key="kmsKey"
+                        )
+                    ),
                     publish_cloud_watch_metrics_enabled=False,
                     remove_bytes_scanned_cutoff_per_query=False,
                     remove_customer_content_encryption_configuration=False,
@@ -2773,6 +3048,7 @@ class CfnWorkGroup(
                 check_type(argname="argument enforce_work_group_configuration", value=enforce_work_group_configuration, expected_type=type_hints["enforce_work_group_configuration"])
                 check_type(argname="argument engine_version", value=engine_version, expected_type=type_hints["engine_version"])
                 check_type(argname="argument execution_role", value=execution_role, expected_type=type_hints["execution_role"])
+                check_type(argname="argument managed_query_results_configuration", value=managed_query_results_configuration, expected_type=type_hints["managed_query_results_configuration"])
                 check_type(argname="argument publish_cloud_watch_metrics_enabled", value=publish_cloud_watch_metrics_enabled, expected_type=type_hints["publish_cloud_watch_metrics_enabled"])
                 check_type(argname="argument remove_bytes_scanned_cutoff_per_query", value=remove_bytes_scanned_cutoff_per_query, expected_type=type_hints["remove_bytes_scanned_cutoff_per_query"])
                 check_type(argname="argument remove_customer_content_encryption_configuration", value=remove_customer_content_encryption_configuration, expected_type=type_hints["remove_customer_content_encryption_configuration"])
@@ -2791,6 +3067,8 @@ class CfnWorkGroup(
                 self._values["engine_version"] = engine_version
             if execution_role is not None:
                 self._values["execution_role"] = execution_role
+            if managed_query_results_configuration is not None:
+                self._values["managed_query_results_configuration"] = managed_query_results_configuration
             if publish_cloud_watch_metrics_enabled is not None:
                 self._values["publish_cloud_watch_metrics_enabled"] = publish_cloud_watch_metrics_enabled
             if remove_bytes_scanned_cutoff_per_query is not None:
@@ -2864,6 +3142,19 @@ class CfnWorkGroup(
             result = self._values.get("execution_role")
             return typing.cast(typing.Optional[builtins.str], result)
 
+        @builtins.property
+        def managed_query_results_configuration(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnWorkGroup.ManagedQueryResultsConfigurationProperty"]]:
+            '''The configuration for the managed query results and encryption option.
+
+            ResultConfiguration and ManagedQueryResultsConfiguration cannot be set at the same time
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-athena-workgroup-workgroupconfigurationupdates.html#cfn-athena-workgroup-workgroupconfigurationupdates-managedqueryresultsconfiguration
+            '''
+            result = self._values.get("managed_query_results_configuration")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnWorkGroup.ManagedQueryResultsConfigurationProperty"]], result)
+
         @builtins.property
         def publish_cloud_watch_metrics_enabled(
             self,
@@ -3001,6 +3292,12 @@ class CfnWorkGroupProps:
                         selected_engine_version="selectedEngineVersion"
                     ),
                     execution_role="executionRole",
+                    managed_query_results_configuration=athena.CfnWorkGroup.ManagedQueryResultsConfigurationProperty(
+                        enabled=False,
+                        encryption_configuration=athena.CfnWorkGroup.ManagedStorageEncryptionConfigurationProperty(
+                            kms_key="kmsKey"
+                        )
+                    ),
                     publish_cloud_watch_metrics_enabled=False,
                     requester_pays_enabled=False,
                     result_configuration=athena.CfnWorkGroup.ResultConfigurationProperty(
@@ -3029,6 +3326,12 @@ class CfnWorkGroupProps:
                         selected_engine_version="selectedEngineVersion"
                     ),
                     execution_role="executionRole",
+                    managed_query_results_configuration=athena.CfnWorkGroup.ManagedQueryResultsConfigurationProperty(
+                        enabled=False,
+                        encryption_configuration=athena.CfnWorkGroup.ManagedStorageEncryptionConfigurationProperty(
+                            kms_key="kmsKey"
+                        )
+                    ),
                     publish_cloud_watch_metrics_enabled=False,
                     remove_bytes_scanned_cutoff_per_query=False,
                     remove_customer_content_encryption_configuration=False,
@@ -3270,6 +3573,14 @@ def _typecheckingstub__05023d61a95576869568bc095d9889b971a9d8c061cba5833a71f4423
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__d5d2a0246fafbbc6a693f337ada29b85155f59962e79d7c642084d44652d0f2e(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    data_catalog_name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__70484df33f57719ba2197f7ae86dd846651ec89bd9dc9853fbc4fff3bb342b5e(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -3483,6 +3794,14 @@ def _typecheckingstub__be0f7d9e26f77f516ae56dabfd6aae7d4d7e7404767cea86eb51dbe5a
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__be43a8d87adff5435c9f23ab60a2b7d950366fdde534d2500f7e413d6b588f9f(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    work_group_name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__a89351b058fb473aa673ca436e54b399faeed90f862768d495efb059a3875b1c(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -3567,6 +3886,21 @@ def _typecheckingstub__89f0b78a82f24ece8384b490252230129c42a711fdb038b4ecd645d32
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__f6c4d2e9be468cb69e158be7cc0f67bd537760da2f65bdfea130a3adceb65198(
+    *,
+    enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+    encryption_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWorkGroup.ManagedStorageEncryptionConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__53549459074bb1d23e4ee2a6fd045c500008070dfc2015833edc260380222a02(
+    *,
+    kms_key: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__86d94b0afb15160d6ec72666a7574c95b2d16afd21c5ca80a9f352f319f2f46c(
     *,
     acl_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWorkGroup.AclConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -3599,6 +3933,7 @@ def _typecheckingstub__5bc58a8f7fc071c8f6e3cf6044079ec303e9ba8521ef96ca98c62cfdd
     enforce_work_group_configuration: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     engine_version: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWorkGroup.EngineVersionProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     execution_role: typing.Optional[builtins.str] = None,
+    managed_query_results_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWorkGroup.ManagedQueryResultsConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     publish_cloud_watch_metrics_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     requester_pays_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     result_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWorkGroup.ResultConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -3614,6 +3949,7 @@ def _typecheckingstub__6d600654f5aa48cb49fd4baf2a677e5f7725dcfa1249836427c1d9f65
     enforce_work_group_configuration: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     engine_version: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWorkGroup.EngineVersionProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     execution_role: typing.Optional[builtins.str] = None,
+    managed_query_results_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWorkGroup.ManagedQueryResultsConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     publish_cloud_watch_metrics_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     remove_bytes_scanned_cutoff_per_query: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     remove_customer_content_encryption_configuration: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,