Back to Checks
aws

Glue development endpoint has S3 encryption enabled

glue_development_endpoints_s3_encryption_enabled
Service: glueSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Other

AWS Glue development endpoints are evaluated for an attached security configuration with S3 encryption. Endpoints lacking a security configuration, or with s3_encryption set to DISABLED, are flagged by this check.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted S3 writes from dev endpoints leave ETL outputs, temp data, and scripts readable at rest. A misconfigured bucket or stolen creds can expose sensitive content, harming confidentiality and triggering compliance issues.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks glue_development_endpoints_s3_encryption_enabled

Recommendation

Attach a Glue security configuration to each dev endpoint with S3 encryption enabled; prefer SSE-KMS with customer-managed keys. Enforce least privilege on IAM and KMS key policies, and extend encryption to logs and bookmarks for defense in depth.

Remediation

Terraform

# Terraform: Glue Dev Endpoint with S3 encryption
resource "aws_glue_security_configuration" "secure" {
  name = "<example_resource_name>"
  encryption_configuration {
    s3_encryption {
      s3_encryption_mode = "SSE-S3"  # CRITICAL: enables S3 encryption
    }
  }
}

resource "aws_glue_dev_endpoint" "dev" {
  name     = "<example_resource_name>"
  role_arn = "<example_role_arn>"

  security_configuration = aws_glue_security_configuration.secure.name  # CRITICAL: attaches encrypted security configuration
}

NativeIaC

# CloudFormation: Glue Dev Endpoint with S3 encryption via Security Configuration
Resources:
  SecurityConfig:
    Type: AWS::Glue::SecurityConfiguration
    Properties:
      Name: <example_resource_name>
      EncryptionConfiguration:
        S3Encryptions:
          - S3EncryptionMode: SSE-S3  # CRITICAL: enables S3 encryption for the security configuration

  DevEndpoint:
    Type: AWS::Glue::DevEndpoint
    Properties:
      EndpointName: <example_resource_name>
      RoleArn: <example_role_arn>
      SecurityConfiguration: !Ref SecurityConfig  # CRITICAL: attaches the encrypted security configuration to the dev endpoint

Other

1In the AWS Console, go to AWS Glue > Security configurations > Create security configuration
2Under S3 encryption, select Server-side encryption (SSE-S3) and save
3Go to AWS Glue > Development endpoints > Create development endpoint
4Fill required fields and set Security configuration to the one created in step 2
5Create the endpoint and delete the old endpoint (without encryption) if it exists

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.glue.glue_client import glue_client


class glue_development_endpoints_s3_encryption_enabled(Check):
    def execute(self):
        findings = []
        for endpoint in glue_client.dev_endpoints:
            no_sec_configs = True
            report = Check_Report_AWS(metadata=self.metadata(), resource=endpoint)
            for sec_config in glue_client.security_configs:
                if sec_config.name == endpoint.security:
                    no_sec_configs = False
                    report.status = "FAIL"
                    report.status_extended = f"Glue development endpoint {endpoint.name} does not have S3 encryption enabled."
                    if sec_config.s3_encryption != "DISABLED":
                        report.status = "PASS"
                        report.status_extended = f"Glue development endpoint {endpoint.name} has S3 encryption enabled with key {sec_config.s3_key_arn}."
            if no_sec_configs:
                report.status = "FAIL"
                report.status_extended = f"Glue development endpoint {endpoint.name} does not have security configuration."
            findings.append(report)
        return findings

References