Glue jobs S3 encryption should be enabled¶

Ensure Glue jobs have S3 encryption enabled to protect sensitive information at rest.

How to fix¶

Attribute encryption_configuration[0].s3_encryption[0].s3_encryption_mode of aws_glue_security_configuration must be non-empty.

Implementation options¶

Choose the option that matches how you manage Terraform. All options satisfy this control.

Option 1: Terraform AWS provider resources¶

If you manage resources directly, configure the relevant Terraform AWS provider resources to meet this control. See docs for the resources involved: aws_glue_security_configuration.

resource "aws_glue_security_configuration" "this" {
  encryption_configuration {
    cloudwatch_encryption {
      cloudwatch_encryption_mode = "SSE-KMS"
      kms_key_arn                = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
    }

    job_bookmarks_encryption {
      job_bookmarks_encryption_mode = "CSE-KMS"
      kms_key_arn                   = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
    }

    s3_encryption {
      kms_key_arn        = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
      s3_encryption_mode = "SSE-KMS"
    }
  }
  name = "pofix-example-security-config"
}

Tool mappings¶

Use these identifiers to cross-reference this control across tools, reports, and evidence.

• Compliance.tf (CTF) Control: glue_job_s3_encryption_enabled

• Powerpipe Control: aws_compliance.control.glue_job_s3_encryption_enabled