Back to Checks
aws

Glue ETL job has CloudWatch Logs encryption enabled

glue_etl_jobs_cloudwatch_logs_encryption_enabled
Service: glueSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsGlueJob

AWS Glue ETL jobs are evaluated for a security configuration with CloudWatch Logs encryption (SSE-KMS) enabled. Jobs without a security configuration, or with CloudWatch Logs encryption set to DISABLED, are highlighted.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted Glue logs weaken confidentiality.

Log entries can expose credentials, PII, connection strings, and schema details. Anyone with log storage access can harvest secrets for lateral movement and data exfiltration, widening the blast radius of compromises.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks glue_etl_jobs_cloudwatch_logs_encryption_enabled

Recommendation

Enable at-rest encryption for Glue logs via a security configuration using customer-managed KMS keys. Apply least privilege to KMS and CloudWatch Logs, rotate keys, and require all jobs to attach an approved configuration. Embed this baseline in IaC for consistent, defense-in-depth coverage.

Remediation

Terraform

# Enable CloudWatch Logs encryption and attach to the Glue job
resource "aws_glue_security_configuration" "example_resource_name" {
  name = "<example_resource_name>"

  encryption_configuration {
    cloudwatch_encryption {
      cloudwatch_encryption_mode = "SSE-KMS"          # Critical: enable CW Logs encryption
      kms_key_arn                = "<example_kms_key_arn>" # Critical: KMS key for encryption
    }
  }
}

resource "aws_glue_job" "example_resource_name" {
  name     = "<example_resource_name>"
  role_arn = "<example_role_arn>"

  command {
    name            = "glueetl"
    script_location = "s3://<example_script_path>"
  }

  security_configuration = aws_glue_security_configuration.example_resource_name.name # Critical: attach security config to job
}

NativeIaC

# CloudFormation: enable CloudWatch Logs encryption and attach to the job
Resources:
  ExampleSecurityConfiguration:
    Type: AWS::Glue::SecurityConfiguration
    Properties:
      Name: <example_resource_name>
      EncryptionConfiguration:
        CloudWatchEncryption:  # Critical: enable CloudWatch Logs encryption for Glue
          CloudWatchEncryptionMode: SSE-KMS  # Critical: must not be DISABLED
          KmsKeyArn: <example_kms_key_arn>   # Critical: KMS key used for encryption

  ExampleJob:
    Type: AWS::Glue::Job
    Properties:
      Role: <example_role_arn>
      Command:
        Name: glueetl
        ScriptLocation: s3://<example_script_path>
      SecurityConfiguration: !Ref ExampleSecurityConfiguration  # Critical: attach security configuration to the job

Other

1In the AWS Glue console, go to Security configurations > Add security configuration
2Enter a name, enable CloudWatch Logs encryption, select SSE-KMS, and choose/provide the KMS key ARN; Save
3Go to Jobs, select the target job, click Edit
4Set Security configuration to the one created in step 2
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.glue.glue_client import glue_client


class glue_etl_jobs_cloudwatch_logs_encryption_enabled(Check):
    def execute(self):
        findings = []
        for job in glue_client.jobs:
            no_sec_configs = True
            report = Check_Report_AWS(metadata=self.metadata(), resource=job)
            for sec_config in glue_client.security_configs:
                if sec_config.name == job.security:
                    no_sec_configs = False
                    report.status = "FAIL"
                    report.status_extended = f"Glue job {job.name} does not have CloudWatch Logs encryption enabled."
                    if sec_config.cw_encryption != "DISABLED":
                        report.status = "PASS"
                        report.status_extended = f"Glue job {job.name} has CloudWatch Logs encryption enabled with key {sec_config.cw_key_arn}."
            if no_sec_configs:
                report.status = "FAIL"
                report.status_extended = (
                    f"Glue job {job.name} does not have security configuration."
                )
            findings.append(report)
        return findings

References