Glue data catalog connection password encryption should be enabled¶

Ensure Glue data catalog connection password encryption is enabled to protect sensitive information at rest.

How to fix¶

Attribute data_catalog_encryption_settings[0].connection_password_encryption[0].return_connection_password_encrypted of aws_glue_data_catalog_encryption_settings must be true.

Implementation options¶

Choose the option that matches how you manage Terraform. All options satisfy this control.

Option 1: Terraform AWS provider resources¶

If you manage resources directly, configure the relevant Terraform AWS provider resources to meet this control. See docs for the resources involved: aws_glue_data_catalog_encryption_settings.

resource "aws_glue_data_catalog_encryption_settings" "this" {
  data_catalog_encryption_settings {
    connection_password_encryption {
      aws_kms_key_id                       = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
      return_connection_password_encrypted = true
    }

    encryption_at_rest {
      catalog_encryption_mode = "SSE-KMS"
      sse_aws_kms_key_id      = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
    }
  }
}

Tool mappings¶

Use these identifiers to cross-reference this control across tools, reports, and evidence.

• Compliance.tf (CTF) Control: glue_data_catalog_encryption_settings_password_encryption_enabled

• Powerpipe Control: aws_compliance.control.glue_data_catalog_encryption_settings_password_encryption_enabled