Check ID: glue_etl_jobs_cloudwatch_logs_encryption_enabled
Provider: AWS
Service: glue
Severity: MEDIUM
Categories: encryption
Resource type: AwsGlueJob

​
What this check verifies

AWS Glue ETL jobs are evaluated for a security configuration with CloudWatch Logs encryption (SSE-KMS) enabled. Jobs without a security configuration, or with CloudWatch Logs encryption set to DISABLED, are highlighted.

​
Risk

Unencrypted Glue logs weaken confidentiality. Log entries can expose credentials, PII, connection strings, and schema details. Anyone with log storage access can harvest secrets for lateral movement and data exfiltration, widening the blast radius of compromises.

​
Recommendation

Enable at-rest encryption for Glue logs via a security configuration using customer-managed KMS keys. Apply least privilege to KMS and CloudWatch Logs, rotate keys, and require all jobs to attach an approved configuration. Embed this baseline in IaC for consistent, defense-in-depth coverage.

​
Remediation

# Enable CloudWatch Logs encryption and attach to the Glue job
resource "aws_glue_security_configuration" "example_resource_name" {
  name = "<example_resource_name>"

  encryption_configuration {
    cloudwatch_encryption {
      cloudwatch_encryption_mode = "SSE-KMS"          # Critical: enable CW Logs encryption
      kms_key_arn                = "<example_kms_key_arn>" # Critical: KMS key for encryption
    }
  }
}

resource "aws_glue_job" "example_resource_name" {
  name     = "<example_resource_name>"
  role_arn = "<example_role_arn>"

  command {
    name            = "glueetl"
    script_location = "s3://<example_script_path>"
  }

  security_configuration = aws_glue_security_configuration.example_resource_name.name # Critical: attach security config to job
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = glue_etl_jobs_cloudwatch_logs_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks