Back to Checks
aws

Glue ETL job has Job bookmark encryption enabled

glue_etl_jobs_job_bookmark_encryption_enabled
Service: glueSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Other

AWS Glue ETL jobs should link a security configuration with job bookmark encryption enabled. Bookmark encryption must not be DISABLED (e.g., use CSE-KMS). Jobs lacking a security configuration are treated as not protecting bookmark metadata.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted job bookmarks in S3 expose execution state and data pointers, reducing confidentiality. Altered bookmarks can trigger reruns, skips, or reprocessing, harming integrity. Missing security configs may also leave logs and temporary objects unencrypted.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks glue_etl_jobs_job_bookmark_encryption_enabled

Recommendation

Attach a Glue security configuration to every job and enable job bookmark encryption (e.g., CSE-KMS). Use customer-managed KMS keys, enforce least privilege on key usage, and rotate keys. For defense in depth, also encrypt S3 temp data and CloudWatch logs in the same configuration.

Remediation

Terraform

# Terraform: Enable Glue Job bookmark encryption via Security Configuration
resource "aws_glue_security_configuration" "<example_resource_name>" {
  name = "<example_resource_name>"

  encryption_configuration {
    job_bookmarks_encryption {
      job_bookmarks_encryption_mode = "CSE-KMS"      # CRITICAL: Enables job bookmark encryption
      kms_key_arn                    = "<example_kms_key_arn>"  # CRITICAL: KMS key for bookmarks
    }
  }
}

NativeIaC

# CloudFormation: Enable Glue Job bookmark encryption via Security Configuration
Resources:
  <example_resource_name>:
    Type: AWS::Glue::SecurityConfiguration
    Properties:
      Name: <example_resource_name>
      EncryptionConfiguration:
        JobBookmarksEncryption:
          JobBookmarksEncryptionMode: CSE-KMS  # CRITICAL: Enables job bookmark encryption
          KmsKeyArn: <example_kms_key_arn>     # CRITICAL: KMS key used to encrypt job bookmarks

Other

1In the AWS Console, go to AWS Glue > Security configurations > Add security configuration
2Enter a name and under Advanced settings enable Job bookmark encryption
3Select a KMS key (or paste the key ARN) and click Create
4Go to AWS Glue > Jobs, select the job, click Edit
5Under Advanced properties, set Security configuration to the one created above
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.glue.glue_client import glue_client


class glue_etl_jobs_job_bookmark_encryption_enabled(Check):
    def execute(self):
        findings = []
        for job in glue_client.jobs:
            no_sec_configs = True
            report = Check_Report_AWS(metadata=self.metadata(), resource=job)
            for sec_config in glue_client.security_configs:
                if sec_config.name == job.security:
                    no_sec_configs = False
                    report.status = "FAIL"
                    report.status_extended = f"Glue job {job.name} does not have Job bookmark encryption enabled."
                    if sec_config.jb_encryption != "DISABLED":
                        report.status = "PASS"
                        report.status_extended = f"Glue job {job.name} has Job bookmark encryption enabled with key {sec_config.jb_key_arn}."
            if no_sec_configs:
                report.status = "FAIL"
                report.status_extended = (
                    f"Glue job {job.name} does not have security configuration."
                )
            findings.append(report)
        return findings

References