Check ID: glue_development_endpoints_job_bookmark_encryption_enabled
Provider: AWS
Service: glue
Severity: MEDIUM
Categories: encryption
Resource type: Other

​
What this check verifies

AWS Glue development endpoints are assessed for an attached security configuration where job bookmark encryption is enabled. Endpoints lacking a security configuration are also identified.

​
Risk

Unencrypted job bookmarks stored in S3 can be read or altered, exposing dataset paths, partitions, and processing state. This enables data discovery, state tampering, and replay/skip of workloads, impacting confidentiality, integrity, and availability of ETL pipelines.

​
Recommendation

Attach a security configuration to each development endpoint and enable job bookmark encryption with a managed KMS key. Apply least privilege to S3 and KMS, rotate keys, and align logs and data stores with consistent encryption for defense in depth. Regularly audit endpoints for missing or outdated configurations.

​
Remediation

# Terraform: Enable Job Bookmark encryption and attach to the Dev Endpoint
resource "aws_glue_security_configuration" "<example_resource_name>" {
  name = "<example_resource_name>"

  encryption_configuration {
    job_bookmarks_encryption {
      job_bookmarks_encryption_mode = "CSE-KMS"   # Critical: enables Job Bookmark encryption
      kms_key_arn                   = "<example_kms_key_arn>"  # Critical: KMS key used for Job Bookmark encryption
    }
  }
}

resource "aws_glue_dev_endpoint" "<example_resource_name>" {
  name                   = "<example_resource_name>"
  role_arn               = "<example_role_arn>"
  security_configuration = aws_glue_security_configuration.<example_resource_name>.name  # Critical: attach the security configuration
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = glue_development_endpoints_job_bookmark_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks