A company uses Amazon Athena for ad-hoc queries against S3 data and needs to separate query execution and history access between users, teams, and applications in the same AWS account. Which solution enforces those permission boundaries?

Athena workgroups are the correct solution because they allow you to isolate query execution, query history, and saved queries. By creating a workgroup for each user, team, or application, you can enforce granular permissions using IAM policies. These policies can reference workgroup tags, enabling fine-grained control over who can access or manage specific workgroups. Incorrect options: S3 bucket policies control access to S3 data, not Athena query execution or history. While S3 access is necessary for Athena, it doesn't address the separation of query-related metadata. IAM roles can define permissions, but simply creating roles without associating them with Athena workgroups doesn't provide the necessary isolation for query execution and history within Athena itself. AWS Glue Data Catalog resource policies control access to metadata (databases, tables) in the Glue Catalog, not Athena query execution or history. While Glue is used by Athena, its policies don't manage Athena's operational aspects.