Check ID: glue_etl_jobs_job_bookmark_encryption_enabled
Provider: AWS
Service: glue
Severity: MEDIUM
Categories: encryption
Resource type: Other

​
What this check verifies

AWS Glue ETL jobs should link a security configuration with job bookmark encryption enabled. Bookmark encryption must not be DISABLED (e.g., use CSE-KMS). Jobs lacking a security configuration are treated as not protecting bookmark metadata.

​
Risk

Unencrypted job bookmarks in S3 expose execution state and data pointers, reducing confidentiality. Altered bookmarks can trigger reruns, skips, or reprocessing, harming integrity. Missing security configs may also leave logs and temporary objects unencrypted.

​
Recommendation

Attach a Glue security configuration to every job and enable job bookmark encryption (e.g., CSE-KMS). Use customer-managed KMS keys, enforce least privilege on key usage, and rotate keys. For defense in depth, also encrypt S3 temp data and CloudWatch logs in the same configuration.

​
Remediation

# Terraform: Enable Glue Job bookmark encryption via Security Configuration
resource "aws_glue_security_configuration" "<example_resource_name>" {
  name = "<example_resource_name>"

  encryption_configuration {
    job_bookmarks_encryption {
      job_bookmarks_encryption_mode = "CSE-KMS"      # CRITICAL: Enables job bookmark encryption
      kms_key_arn                    = "<example_kms_key_arn>"  # CRITICAL: KMS key for bookmarks
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = glue_etl_jobs_job_bookmark_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks