Back to Checks
aws

Glue Data Catalog metadata is encrypted with KMS

glue_data_catalogs_metadata_encryption_enabled
Service: glueSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Other

AWS Glue Data Catalog metadata is encrypted at rest when catalog settings use SSE-KMS with a KMS key.

Catalogs that do not configure SSE-KMS for metadata are considered unencrypted.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted catalog metadata exposes schemas, partitions, and data locations, reducing confidentiality.

Adversaries or over-privileged users can conduct reconnaissance and plan lateral movement; tampering with definitions can corrupt queries and results, impacting integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks glue_data_catalogs_metadata_encryption_enabled

Recommendation

Enable metadata encryption with SSE-KMS, preferably using a customer-managed KMS key for control and rotation.

Apply least privilege to KMS and catalog access, restrict who can change settings, and monitor key usage. Use defense in depth by encrypting related analytics assets consistently.

Remediation

CLI

aws glue put-data-catalog-encryption-settings --data-catalog-encryption-settings '{"EncryptionAtRest":{"CatalogEncryptionMode":"SSE-KMS"}}'

Terraform

# Enable Glue Data Catalog metadata encryption with KMS
resource "aws_glue_data_catalog_encryption_settings" "<example_resource_name>" {
  data_catalog_encryption_settings {
    encryption_at_rest {
      catalog_encryption_mode = "SSE-KMS" # Critical: turns on KMS encryption for catalog metadata
    }
  }
}

NativeIaC

# Enable Glue Data Catalog metadata encryption with KMS
Resources:
  <example_resource_name>:
    Type: AWS::Glue::DataCatalogEncryptionSettings
    Properties:
      DataCatalogEncryptionSettings:
        EncryptionAtRest:
          CatalogEncryptionMode: SSE-KMS  # Critical: enables KMS encryption for catalog metadata

Other

1In the AWS Console, go to AWS Glue
2Open Data Catalog > Settings
3Under Security configuration and encryption, check Metadata encryption
4Leave the default AWS managed key selected (or choose a KMS key)
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.glue.glue_client import glue_client


class glue_data_catalogs_metadata_encryption_enabled(Check):
    def execute(self):
        findings = []
        for data_catalog in glue_client.data_catalogs.values():
            # Check only if there are Glue Tables
            if data_catalog.tables or glue_client.provider.scan_unused_services:
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=data_catalog
                )
                report.resource_id = glue_client.audited_account
                report.resource_arn = glue_client._get_data_catalog_arn_template(
                    data_catalog.region
                )
                report.status = "FAIL"
                report.status_extended = (
                    "Glue data catalog settings have metadata encryption disabled."
                )
                if (
                    data_catalog.encryption_settings
                    and data_catalog.encryption_settings.mode == "SSE-KMS"
                ):
                    report.status = "PASS"
                    report.status_extended = f"Glue data catalog settings have metadata encryption enabled with KMS key {data_catalog.encryption_settings.kms_id}."
                findings.append(report)
        return findings

References