Back to Checks
aws

Glue development endpoint has CloudWatch Logs encryption enabled

glue_development_endpoints_cloudwatch_logs_encryption_enabled
Service: glueSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Other

AWS Glue development endpoints are assessed for an associated security configuration that enables CloudWatch Logs encryption. It confirms the endpoint references a configuration and that log encryption is not DISABLED.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted Glue logs erode confidentiality: credentials, connection strings, and data samples may be readable to unintended principals, enabling lateral movement. Lack of KMS-backed encryption weakens auditability and separation of duties.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks glue_development_endpoints_cloudwatch_logs_encryption_enabled

Recommendation

Attach a security configuration to all development endpoints with CloudWatch Logs encryption enabled using a tightly scoped KMS key. Apply least privilege to key and log access, rotate keys, and standardize configs via IaC to enforce defense in depth.

Remediation

Terraform

# Glue Security Configuration with CloudWatch Logs encryption enabled
resource "aws_glue_security_configuration" "<example_resource_name>" {
  name = "<example_resource_name>"

  encryption_configuration {
    cloudwatch_encryption {
      cloudwatch_encryption_mode = "SSE-KMS"  # Critical: enables CloudWatch Logs encryption
      kms_key_arn                = "<kms_key_arn>"  # Critical: KMS key used for encrypting Glue logs
    }

    # Required blocks for valid config (kept minimal)
    job_bookmarks_encryption { job_bookmarks_encryption_mode = "DISABLED" }
    s3_encryption             { s3_encryption_mode             = "DISABLED" }
  }
}

NativeIaC

# CloudFormation: Glue Security Configuration with CloudWatch Logs encryption enabled
Resources:
  <example_resource_name>:
    Type: AWS::Glue::SecurityConfiguration
    Properties:
      Name: <example_resource_name>
      EncryptionConfiguration:
        CloudWatchEncryption:
          CloudWatchEncryptionMode: SSE-KMS  # Critical: enables CloudWatch Logs encryption
          KmsKeyArn: <kms_key_arn>           # Critical: KMS key used for encrypting Glue logs

Other

1In the AWS Console, go to Glue > Security configurations > Add security configuration
2Enter a name and enable CloudWatch Logs encryption
3Select a KMS key (or enter its ARN) and click Create
4Go to Glue > Dev endpoints
5Create a new Dev endpoint (or delete and recreate the existing one) and select the new Security configuration
6Create the endpoint to apply the encryption

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.glue.glue_client import glue_client


class glue_development_endpoints_cloudwatch_logs_encryption_enabled(Check):
    def execute(self):
        findings = []
        for endpoint in glue_client.dev_endpoints:
            no_sec_configs = True
            report = Check_Report_AWS(metadata=self.metadata(), resource=endpoint)
            for sec_config in glue_client.security_configs:
                if sec_config.name == endpoint.security:
                    no_sec_configs = False
                    report.status = "FAIL"
                    report.status_extended = f"Glue development endpoint {endpoint.name} does not have CloudWatch logs encryption enabled."
                    if sec_config.cw_encryption != "DISABLED":
                        report.status = "PASS"
                        report.status_extended = f"Glue development endpoint {endpoint.name} has CloudWatch logs encryption enabled with key {sec_config.cw_key_arn}."
            if no_sec_configs:
                report.status = "FAIL"
                report.status_extended = f"Glue development endpoint {endpoint.name} does not have security configuration."
            findings.append(report)
        return findings

References