Back to Checks
aws

Glue development endpoint has Job Bookmark encryption enabled

glue_development_endpoints_job_bookmark_encryption_enabled
Service: glueSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Other

AWS Glue development endpoints are assessed for an attached security configuration where job bookmark encryption is enabled. Endpoints lacking a security configuration are also identified.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted job bookmarks stored in S3 can be read or altered, exposing dataset paths, partitions, and processing state. This enables data discovery, state tampering, and replay/skip of workloads, impacting confidentiality, integrity, and availability of ETL pipelines.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks glue_development_endpoints_job_bookmark_encryption_enabled

Recommendation

Attach a security configuration to each development endpoint and enable job bookmark encryption with a managed KMS key. Apply least privilege to S3 and KMS, rotate keys, and align logs and data stores with consistent encryption for defense in depth. Regularly audit endpoints for missing or outdated configurations.

Remediation

Terraform

# Terraform: Enable Job Bookmark encryption and attach to the Dev Endpoint
resource "aws_glue_security_configuration" "<example_resource_name>" {
  name = "<example_resource_name>"

  encryption_configuration {
    job_bookmarks_encryption {
      job_bookmarks_encryption_mode = "CSE-KMS"   # Critical: enables Job Bookmark encryption
      kms_key_arn                   = "<example_kms_key_arn>"  # Critical: KMS key used for Job Bookmark encryption
    }
  }
}

resource "aws_glue_dev_endpoint" "<example_resource_name>" {
  name                   = "<example_resource_name>"
  role_arn               = "<example_role_arn>"
  security_configuration = aws_glue_security_configuration.<example_resource_name>.name  # Critical: attach the security configuration
}

NativeIaC

# CloudFormation: Enable Job Bookmark encryption and attach to the Dev Endpoint
Resources:
  GlueSecurityConfiguration:
    Type: AWS::Glue::SecurityConfiguration
    Properties:
      Name: <example_resource_name>
      EncryptionConfiguration:
        JobBookmarksEncryption:
          JobBookmarksEncryptionMode: CSE-KMS  # Critical: enables Job Bookmark encryption
          KmsKeyArn: <example_kms_key_arn>     # Critical: KMS key used for Job Bookmark encryption

  GlueDevEndpoint:
    Type: AWS::Glue::DevEndpoint
    Properties:
      RoleArn: <example_role_arn>
      SecurityConfiguration: !Ref GlueSecurityConfiguration  # Critical: attach the security configuration to the Dev Endpoint

Other

1In the AWS Console, go to Glue > Security configurations > Add security configuration
2Enter a name, then under Advanced settings enable Job bookmark encryption and select a KMS key (or enter its ARN); Save
3Go to Glue > Dev endpoints
4Create a new Dev endpoint (or recreate the existing one) and set Security configuration to the configuration created in step 2
5Create the endpoint to apply the setting

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.glue.glue_client import glue_client


class glue_development_endpoints_job_bookmark_encryption_enabled(Check):
    def execute(self):
        findings = []
        for endpoint in glue_client.dev_endpoints:
            no_sec_configs = True
            report = Check_Report_AWS(metadata=self.metadata(), resource=endpoint)
            for sec_config in glue_client.security_configs:
                if sec_config.name == endpoint.security:
                    no_sec_configs = False
                    report.status = "FAIL"
                    report.status_extended = f"Glue development endpoint {endpoint.name} does not have Job Bookmark encryption enabled."
                    if sec_config.jb_encryption != "DISABLED":
                        report.status = "PASS"
                        report.status_extended = f"Glue development endpoint {endpoint.name} has Job Bookmark encryption enabled with key {sec_config.jb_key_arn}."
            if no_sec_configs:
                report.status = "FAIL"
                report.status_extended = f"Glue development endpoint {endpoint.name} does not have security configuration."
            findings.append(report)
        return findings

References