Glue connection has SSL enabled

Check ID: glue_database_connections_ssl_enabled
Provider: AWS
Service: glue
Severity: HIGH
Categories: encryption
Resource type: Other

What this check verifies

AWS Glue connections require TLS/SSL for JDBC when the JDBC_ENFORCE_SSL property is set to true. This evaluates connection definitions to confirm SSL is enforced for traffic to external data stores.

Risk

Absent TLS enforcement, JDBC traffic-including credentials, queries, and results-can be intercepted or modified in transit. This enables:

Confidentiality loss via sniffing/MITM
Integrity tampering of queries/results
Credential theft leading to broader database access

Recommendation

Enforce TLS on all Glue connections (set JDBC_ENFORCE_SSL=true) and require encryption on target databases. Apply defense in depth: validate certificates, restrict network exposure, prefer private connectivity, and use least-privilege credentials with rotation.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws glue update-connection --name <example_resource_name> --connection-input '{"Name":"<example_resource_name>","ConnectionType":"JDBC","ConnectionProperties":{"JDBC_CONNECTION_URL":"<example_jdbc_url>","JDBC_ENFORCE_SSL":"true"}}'

# Terraform: Enable SSL on a Glue JDBC connection
resource "aws_glue_connection" "<example_resource_name>" {
  name            = "<example_resource_name>"
  connection_type = "JDBC"

  connection_properties = {
    JDBC_CONNECTION_URL = "<example_jdbc_url>"
    JDBC_ENFORCE_SSL    = "true"  # Critical: forces SSL for the JDBC connection
  }
}

# CloudFormation: Enable SSL on a Glue JDBC connection
Resources:
  <example_resource_name>:
    Type: AWS::Glue::Connection
    Properties:
      ConnectionInput:
        ConnectionType: JDBC
        ConnectionProperties:
          JDBC_CONNECTION_URL: "<example_jdbc_url>"
          JDBC_ENFORCE_SSL: "true"  # Critical: forces SSL for the JDBC connection

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = glue_database_connections_ssl_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Glue Data Catalog resource policy is not public Glue development endpoint encrypts CloudWatch Logs

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires