Glue ETL job has no secrets in default arguments

Check ID: glue_etl_jobs_no_secrets_in_arguments
Provider: AWS
Service: glue
Severity: CRITICAL
Categories: secrets
Resource type: Other

What this check verifies

AWS Glue ETL jobs are inspected for default arguments (DefaultArguments) that resemble secrets (keys, tokens, passwords). Such values indicate sensitive data is stored directly in job arguments instead of being sourced securely from AWS Secrets Manager or Systems Manager Parameter Store.

Risk

Plaintext secrets in default arguments reduce confidentiality: values can be viewed in consoles, CLI output, and CloudTrail logs. Compromised credentials enable unauthorized AWS actions, data exfiltration, and lateral movement across the environment.

Recommendation

Store secrets in AWS Secrets Manager or AWS Systems Manager Parameter Store and reference them by name or ARN in job arguments instead of embedding plaintext values. Enforce least privilege on the Glue job IAM role, rotate secrets regularly, and avoid logging or exporting argument values.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws glue update-job --job-name <job_name> --job-update '{"DefaultArguments":{"--secret_name":"{{resolve:secretsmanager:my-secret}}"}}'

resource "aws_glue_job" "example" {
  name     = "<job_name>"
  role_arn = "<role_arn>"

  command {
    script_location = "s3://<bucket>/script.py"
  }

  default_arguments = {
    "--secret_name" = aws_secretsmanager_secret_version.example.secret_string  # Reference secret from Secrets Manager instead of plaintext
  }
}

Resources:
  GlueJob:
    Type: AWS::Glue::Job
    Properties:
      Name: <job_name>
      Role: <role_arn>
      Command:
        Name: glueetl
        ScriptLocation: "s3://<bucket>/script.py"
      DefaultArguments:
        "--secret_name": !Sub "{{resolve:secretsmanager:${MySecret}}}"  # Reference secret from Secrets Manager instead of plaintext

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = glue_etl_jobs_no_secrets_in_arguments. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Glue ETL job has continuous CloudWatch logging enabled Glue ML Transform is encrypted at rest

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires