Glue ML Transform is encrypted at rest

Check ID: glue_ml_transform_encrypted_at_rest
Provider: AWS
Service: glue
Severity: MEDIUM
Categories: encryption
Resource type: Other

What this check verifies

AWS Glue ML transforms are evaluated for encryption at rest of transform user data using KMS keys. The finding highlights transforms where encryption is not configured.

Risk

Without encryption, confidentiality is weakened: transform artifacts, mappings, and sample datasets may be readable via storage access, backups, or cross-account exposure. This can lead to data disclosure and aid lateral movement by revealing schemas and data relationships.

Recommendation

Enable KMS-backed encryption at rest for all ML transforms and prefer customer-managed keys.

Apply least privilege key policies and rotate keys
Enforce defense in depth with network and IAM controls
Monitor key usage and transform access with audit logs

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws glue update-ml-transform --transform-id <transform-id> --transform-encryption '{"MlUserDataEncryption":{"MlUserDataEncryptionMode":"SSE-KMS","KmsKeyId":"<kms-key-arn>"}}'

resource "aws_glue_ml_transform" "<example_resource_name>" {
  name     = "<example_resource_name>"
  role_arn = "<example_resource_id>"

  input_record_tables {
    database_name = "<example_resource_name>"
    table_name    = "<example_resource_name>"
  }

  parameters {
    transform_type = "FIND_MATCHES"
    find_matches_parameters {
      primary_key_column_name = "<example_resource_name>"
    }
  }

  transform_encryption {
    ml_user_data_encryption {
      ml_user_data_encryption_mode = "SSE-KMS"   # Critical: enables encryption at rest
      kms_key_id                   = "<kms-key-arn>" # Critical: KMS key used for encryption
    }
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::Glue::MLTransform
    Properties:
      Role: <example_resource_id>
      InputRecordTables:
        - DatabaseName: <example_resource_name>
          TableName: <example_resource_name>
      TransformParameters:
        TransformType: FIND_MATCHES
        FindMatchesParameters:
          PrimaryKeyColumnName: <example_resource_name>
      TransformEncryption:
        MlUserDataEncryption:
          MlUserDataEncryptionMode: SSE-KMS  # Critical: enables ML user data encryption at rest
          KmsKeyId: <kms-key-arn>            # Critical: KMS key used for encryption

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = glue_ml_transform_encrypted_at_rest. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Glue ETL job has no secrets in default arguments GuardDuty detector is centrally managed by an admin account

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires