Back to Checks
aws

Glue connection has SSL enabled

glue_database_connections_ssl_enabled
Service: glueSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Other

AWS Glue connections require TLS/SSL for JDBC when the JDBC_ENFORCE_SSL property is set to true.

This evaluates connection definitions to confirm SSL is enforced for traffic to external data stores.

Prowler logoProwlerprowler-provider-aws

Risk

Absent TLS enforcement, JDBC traffic-including credentials, queries, and results-can be intercepted or modified in transit.

This enables:

  • Confidentiality loss via sniffing/MITM
  • Integrity tampering of queries/results
  • Credential theft leading to broader database access

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks glue_database_connections_ssl_enabled

Recommendation

Enforce TLS on all Glue connections (set JDBC_ENFORCE_SSL=true) and require encryption on target databases.

Apply defense in depth: validate certificates, restrict network exposure, prefer private connectivity, and use least-privilege credentials with rotation.

Remediation

CLI

aws glue update-connection --name <example_resource_name> --connection-input '{"Name":"<example_resource_name>","ConnectionType":"JDBC","ConnectionProperties":{"JDBC_CONNECTION_URL":"<example_jdbc_url>","JDBC_ENFORCE_SSL":"true"}}'

Terraform

# Terraform: Enable SSL on a Glue JDBC connection
resource "aws_glue_connection" "<example_resource_name>" {
  name            = "<example_resource_name>"
  connection_type = "JDBC"

  connection_properties = {
    JDBC_CONNECTION_URL = "<example_jdbc_url>"
    JDBC_ENFORCE_SSL    = "true"  # Critical: forces SSL for the JDBC connection
  }
}

NativeIaC

# CloudFormation: Enable SSL on a Glue JDBC connection
Resources:
  <example_resource_name>:
    Type: AWS::Glue::Connection
    Properties:
      ConnectionInput:
        ConnectionType: JDBC
        ConnectionProperties:
          JDBC_CONNECTION_URL: "<example_jdbc_url>"
          JDBC_ENFORCE_SSL: "true"  # Critical: forces SSL for the JDBC connection

Other

1Open the AWS Console and go to AWS Glue > Data Catalog > Connections
2Select the connection and click Edit
3In Connection properties (Advanced properties), add key JDBC_ENFORCE_SSL with value true (or check Require SSL)
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.glue.glue_client import glue_client


class glue_database_connections_ssl_enabled(Check):
    def execute(self):
        findings = []
        for conn in glue_client.connections:
            report = Check_Report_AWS(metadata=self.metadata(), resource=conn)
            report.status = "FAIL"
            report.status_extended = (
                f"Glue connection {conn.name} has SSL connection disabled."
            )
            if conn.properties.get("JDBC_ENFORCE_SSL") == "true":
                report.status = "PASS"
                report.status_extended = (
                    f"Glue connection {conn.name} has SSL connection enabled."
                )
            findings.append(report)
        return findings

References