Check ID: glue_etl_jobs_amazon_s3_encryption_enabled
Provider: AWS
Service: glue
Severity: HIGH
Categories: encryption
Resource type: Other

​
What this check verifies

AWS Glue ETL jobs are validated to use Amazon S3 at-rest encryption (SSE-S3 or SSE-KMS) when writing outputs, either through an attached security configuration or via job arguments. Jobs missing a security configuration or with S3 encryption disabled are identified.

​
Risk

Storing job outputs in S3 without at-rest encryption weakens confidentiality. Plaintext objects can be exposed via misconfigured bucket policies, compromised credentials, or media reuse, and lack KMS key controls, rotation, and audit trails-hindering incident response and compliance.

​
Recommendation

Require S3 encryption for all Glue jobs via security configurations, preferring SSE-KMS. Apply least privilege to KMS keys, restrict key usage and rotate regularly. Enforce defense-in-depth with bucket policies that require encrypted writes, and monitor with key and S3 access logs.

​
Remediation

# Terraform: Attach a Security Configuration with S3 encryption to a Glue job
resource "aws_glue_security_configuration" "sec" {
  name = "<example_resource_name>"

  s3_encryption {
    s3_encryption_mode = "SSE-S3"  # CRITICAL: Enables S3 encryption for Glue outputs
  }
}

resource "aws_glue_job" "job" {
  name     = "<example_resource_name>"
  role_arn = "<example_role_arn>"

  command {
    script_location = "s3://<example_resource_name>/script.py"
  }

  security_configuration = aws_glue_security_configuration.sec.name  # CRITICAL: Applies encrypted security configuration to the job
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = glue_etl_jobs_amazon_s3_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks