Glue Data Catalog metadata is encrypted with KMS

Check ID: glue_data_catalogs_metadata_encryption_enabled
Provider: AWS
Service: glue
Severity: MEDIUM
Categories: encryption
Resource type: Other

What this check verifies

AWS Glue Data Catalog metadata is encrypted at rest when catalog settings use SSE-KMS with a KMS key. Catalogs that do not configure SSE-KMS for metadata are considered unencrypted.

Risk

Unencrypted catalog metadata exposes schemas, partitions, and data locations, reducing confidentiality. Adversaries or over-privileged users can conduct reconnaissance and plan lateral movement; tampering with definitions can corrupt queries and results, impacting integrity.

Recommendation

Enable metadata encryption with SSE-KMS, preferably using a customer-managed KMS key for control and rotation. Apply least privilege to KMS and catalog access, restrict who can change settings, and monitor key usage. Use defense in depth by encrypting related analytics assets consistently.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws glue put-data-catalog-encryption-settings --data-catalog-encryption-settings '{"EncryptionAtRest":{"CatalogEncryptionMode":"SSE-KMS"}}'

# Enable Glue Data Catalog metadata encryption with KMS
resource "aws_glue_data_catalog_encryption_settings" "<example_resource_name>" {
  data_catalog_encryption_settings {
    encryption_at_rest {
      catalog_encryption_mode = "SSE-KMS" # Critical: turns on KMS encryption for catalog metadata
    }
  }
}

# Enable Glue Data Catalog metadata encryption with KMS
Resources:
  <example_resource_name>:
    Type: AWS::Glue::DataCatalogEncryptionSettings
    Properties:
      DataCatalogEncryptionSettings:
        EncryptionAtRest:
          CatalogEncryptionMode: SSE-KMS  # Critical: enables KMS encryption for catalog metadata

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = glue_data_catalogs_metadata_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Glue data catalog connection password is KMS-encrypted Glue Data Catalog resource policy is not public

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires