Check ID: glue_development_endpoints_s3_encryption_enabled
Provider: AWS
Service: glue
Severity: MEDIUM
Categories: encryption
Resource type: Other

​
What this check verifies

AWS Glue development endpoints are evaluated for an attached security configuration with S3 encryption. Endpoints lacking a security configuration, or with s3_encryption set to DISABLED, are flagged by this check.

​
Risk

Unencrypted S3 writes from dev endpoints leave ETL outputs, temp data, and scripts readable at rest. A misconfigured bucket or stolen creds can expose sensitive content, harming confidentiality and triggering compliance issues.

​
Recommendation

Attach a Glue security configuration to each dev endpoint with S3 encryption enabled; prefer SSE-KMS with customer-managed keys. Enforce least privilege on IAM and KMS key policies, and extend encryption to logs and bookmarks for defense in depth.

​
Remediation

# Terraform: Glue Dev Endpoint with S3 encryption
resource "aws_glue_security_configuration" "secure" {
  name = "<example_resource_name>"
  encryption_configuration {
    s3_encryption {
      s3_encryption_mode = "SSE-S3"  # CRITICAL: enables S3 encryption
    }
  }
}

resource "aws_glue_dev_endpoint" "dev" {
  name     = "<example_resource_name>"
  role_arn = "<example_role_arn>"

  security_configuration = aws_glue_security_configuration.secure.name  # CRITICAL: attaches encrypted security configuration
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = glue_development_endpoints_s3_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks