Back to Checks
aws

Glue data catalog connection password is encrypted with a KMS key

glue_data_catalogs_connection_passwords_encryption_enabled
Service: glueSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Other

AWS Glue Data Catalog settings for connection password encryption are evaluated to confirm an AWS KMS key is configured to encrypt passwords stored in connection properties.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted connection passwords can be read from the catalog or responses, letting attackers or over-privileged users obtain database credentials. This jeopardizes confidentiality of linked data stores, enables unauthorized modifications, and can facilitate lateral movement across environments.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks glue_data_catalogs_connection_passwords_encryption_enabled

Recommendation

Enable connection password encryption in the Data Catalog with a customer-managed KMS key.

  • Apply least privilege to the KMS key and Glue roles
  • Prefer keeping responses encrypted (ReturnConnectionPasswordEncrypted)
  • Rotate keys and monitor access for defense in depth

Remediation

CLI

aws glue put-data-catalog-encryption-settings --data-catalog-encryption-settings '{"ConnectionPasswordEncryption":{"ReturnConnectionPasswordEncrypted":true,"AwsKmsKeyId":"<kms_key_arn>"}}'

Terraform

# Enable Glue Data Catalog connection password encryption
resource "aws_glue_data_catalog_encryption_settings" "<example_resource_name>" {
  data_catalog_encryption_settings {
    # Critical: enables password encryption with a KMS key
    connection_password_encryption {
      return_connection_password_encrypted = true
      aws_kms_key_id                       = "<kms_key_arn>"
    }

    # Required block for this resource; keep minimal
    encryption_at_rest {
      catalog_encryption_mode = "DISABLED"
    }
  }
}

NativeIaC

# CloudFormation: enable Glue Data Catalog connection password encryption
Resources:
  <example_resource_name>:
    Type: AWS::Glue::DataCatalogEncryptionSettings
    Properties:
      DataCatalogEncryptionSettings:
        ConnectionPasswordEncryption:
          ReturnConnectionPasswordEncrypted: true  # Critical: encrypts connection passwords
          KmsKeyId: <kms_key_arn>  # Critical: KMS key used for encryption

Other

1In the AWS Console, go to AWS Glue
2Click Settings (left menu)
3Under Data catalog settings, check Encrypt connection passwords
4Select your KMS key (symmetric CMK)
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.glue.glue_client import glue_client


class glue_data_catalogs_connection_passwords_encryption_enabled(Check):
    def execute(self):
        findings = []
        for data_catalog in glue_client.data_catalogs.values():
            # Check only if there are Glue Tables
            if data_catalog.tables or glue_client.provider.scan_unused_services:
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=data_catalog
                )
                report.resource_id = glue_client.audited_account
                report.resource_arn = glue_client._get_data_catalog_arn_template(
                    data_catalog.region
                )
                report.status = "FAIL"
                report.status = "FAIL"
                report.status_extended = (
                    "Glue data catalog connection password is not encrypted."
                )
                if (
                    data_catalog.encryption_settings
                    and data_catalog.encryption_settings.password_encryption
                ):
                    report.status = "PASS"
                    report.status_extended = f"Glue data catalog connection password is encrypted with KMS key {data_catalog.encryption_settings.password_kms_id}."
                findings.append(report)
        return findings

References