Check ID: glue_development_endpoints_cloudwatch_logs_encryption_enabled
Provider: AWS
Service: glue
Severity: MEDIUM
Categories: encryption
Resource type: Other

​
What this check verifies

AWS Glue development endpoints are assessed for an associated security configuration that enables CloudWatch Logs encryption. It confirms the endpoint references a configuration and that log encryption is not DISABLED.

​
Risk

Unencrypted Glue logs erode confidentiality: credentials, connection strings, and data samples may be readable to unintended principals, enabling lateral movement. Lack of KMS-backed encryption weakens auditability and separation of duties.

​
Recommendation

Attach a security configuration to all development endpoints with CloudWatch Logs encryption enabled using a tightly scoped KMS key. Apply least privilege to key and log access, rotate keys, and standardize configs via IaC to enforce defense in depth.

​
Remediation

# Glue Security Configuration with CloudWatch Logs encryption enabled
resource "aws_glue_security_configuration" "<example_resource_name>" {
  name = "<example_resource_name>"

  encryption_configuration {
    cloudwatch_encryption {
      cloudwatch_encryption_mode = "SSE-KMS"  # Critical: enables CloudWatch Logs encryption
      kms_key_arn                = "<kms_key_arn>"  # Critical: KMS key used for encrypting Glue logs
    }

    # Required blocks for valid config (kept minimal)
    job_bookmarks_encryption { job_bookmarks_encryption_mode = "DISABLED" }
    s3_encryption             { s3_encryption_mode             = "DISABLED" }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = glue_development_endpoints_cloudwatch_logs_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks