Glue ETL job has continuous CloudWatch logging enabled

Check ID: glue_etl_jobs_logging_enabled
Provider: AWS
Service: glue
Severity: MEDIUM
Categories: logging
Resource type: Other

What this check verifies

AWS Glue jobs are assessed for continuous CloudWatch logging, confirming that runtime events and outputs are sent to CloudWatch Logs via the --enable-continuous-cloudwatch-log configuration.

Risk

Missing job logs hide execution details and access patterns, enabling undetected credential abuse, data exfiltration in scripts, or tampering with transforms. This reduces confidentiality and integrity, hinders incident response, and can mask failures that impact availability.

Recommendation

Enable continuous logging to CloudWatch Logs for all Glue jobs. Centralize logs with retention and KMS encryption, restrict read access, and alert on anomalies and failures. Apply least privilege to job roles and use defense in depth by correlating logs across services.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws glue update-job --job-name <example_resource_name> --job-update '{"DefaultArguments":{"--enable-continuous-cloudwatch-log":"true"}}'

resource "aws_glue_job" "<example_resource_name>" {
  name     = "<example_resource_name>"
  role_arn = "<example_resource_id>"

  command {
    script_location = "s3://<example_resource_name>/script.py"
  }

  default_arguments = {
    "--enable-continuous-cloudwatch-log" = "true" # Critical: enables continuous CloudWatch logging to pass the check
  }
}

Resources:
  GlueJob:
    Type: AWS::Glue::Job
    Properties:
      Role: "<example_resource_id>"
      Command:
        Name: glueetl
        ScriptLocation: "s3://<example_resource_name>/script.py"
      DefaultArguments:
        "--enable-continuous-cloudwatch-log": "true"  # Critical: enables continuous CloudWatch logging to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = glue_etl_jobs_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Glue ETL job has Job bookmark encryption enabled Glue ETL job has no secrets in default arguments

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires