Glue data catalog connection password is KMS-encrypted

Check ID: glue_data_catalogs_connection_passwords_encryption_enabled
Provider: AWS
Service: glue
Severity: HIGH
Categories: encryption
Resource type: Other

What this check verifies

AWS Glue Data Catalog settings for connection password encryption are evaluated to confirm an AWS KMS key is configured to encrypt passwords stored in connection properties.

Risk

Unencrypted connection passwords can be read from the catalog or responses, letting attackers or over-privileged users obtain database credentials. This jeopardizes confidentiality of linked data stores, enables unauthorized modifications, and can facilitate lateral movement across environments.

Recommendation

Enable connection password encryption in the Data Catalog with a customer-managed KMS key.

Apply least privilege to the KMS key and Glue roles
Prefer keeping responses encrypted (ReturnConnectionPasswordEncrypted)
Rotate keys and monitor access for defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws glue put-data-catalog-encryption-settings --data-catalog-encryption-settings '{"ConnectionPasswordEncryption":{"ReturnConnectionPasswordEncrypted":true,"AwsKmsKeyId":"<kms_key_arn>"}}'

# Enable Glue Data Catalog connection password encryption
resource "aws_glue_data_catalog_encryption_settings" "<example_resource_name>" {
  data_catalog_encryption_settings {
    # Critical: enables password encryption with a KMS key
    connection_password_encryption {
      return_connection_password_encrypted = true
      aws_kms_key_id                       = "<kms_key_arn>"
    }

    # Required block for this resource; keep minimal
    encryption_at_rest {
      catalog_encryption_mode = "DISABLED"
    }
  }
}

# CloudFormation: enable Glue Data Catalog connection password encryption
Resources:
  <example_resource_name>:
    Type: AWS::Glue::DataCatalogEncryptionSettings
    Properties:
      DataCatalogEncryptionSettings:
        ConnectionPasswordEncryption:
          ReturnConnectionPasswordEncrypted: true  # Critical: encrypts connection passwords
          KmsKeyId: <kms_key_arn>  # Critical: KMS key used for encryption

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = glue_data_catalogs_connection_passwords_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

S3 Glacier vault policy does not allow public access Glue Data Catalog metadata is encrypted with KMS

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires