Back to Checks
aws

Glue ETL job has continuous CloudWatch logging enabled

glue_etl_jobs_logging_enabled
Service: glueSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:Other

AWS Glue jobs are assessed for continuous CloudWatch logging, confirming that runtime events and outputs are sent to CloudWatch Logs via the --enable-continuous-cloudwatch-log configuration.

Prowler logoProwlerprowler-provider-aws

Risk

Missing job logs hide execution details and access patterns, enabling undetected credential abuse, data exfiltration in scripts, or tampering with transforms. This reduces confidentiality and integrity, hinders incident response, and can mask failures that impact availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks glue_etl_jobs_logging_enabled

Recommendation

Enable continuous logging to CloudWatch Logs for all Glue jobs. Centralize logs with retention and KMS encryption, restrict read access, and alert on anomalies and failures. Apply least privilege to job roles and use defense in depth by correlating logs across services.

Remediation

CLI

aws glue update-job --job-name <example_resource_name> --job-update '{"DefaultArguments":{"--enable-continuous-cloudwatch-log":"true"}}'

Terraform

resource "aws_glue_job" "<example_resource_name>" {
  name     = "<example_resource_name>"
  role_arn = "<example_resource_id>"

  command {
    script_location = "s3://<example_resource_name>/script.py"
  }

  default_arguments = {
    "--enable-continuous-cloudwatch-log" = "true" # Critical: enables continuous CloudWatch logging to pass the check
  }
}

NativeIaC

Resources:
  GlueJob:
    Type: AWS::Glue::Job
    Properties:
      Role: "<example_resource_id>"
      Command:
        Name: glueetl
        ScriptLocation: "s3://<example_resource_name>/script.py"
      DefaultArguments:
        "--enable-continuous-cloudwatch-log": "true"  # Critical: enables continuous CloudWatch logging to pass the check

Other

1Open the AWS Glue console and go to Jobs
2Select the job and click Edit
3Expand Advanced properties
4Under Continuous logging, check Enable logs in CloudWatch
5Save

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.glue.glue_client import glue_client


class glue_etl_jobs_logging_enabled(Check):
    """Check if Glue ETL jobs have logging enabled.

    This check will return FAIL if the Glue ETL job does not have logging enabled.
    """

    def execute(self) -> List[Check_Report_AWS]:
        """Execute the Glue ETL jobs logging enabled check.

        Iterate over all Glue ETL jobs and check if they have logging enabled.

        Returns:
            List[Check_Report_AWS]: A list of report objects with the results of the check.
        """
        findings = []
        for job in glue_client.jobs:
            report = Check_Report_AWS(metadata=self.metadata(), resource=job)
            report.status = "FAIL"
            report.status_extended = (
                f"Glue job {job.name} does not have logging enabled."
            )

            if (
                job.arguments.get("--enable-continuous-cloudwatch-log", "false")
                == "true"
            ):
                report.status = "PASS"
                report.status_extended = f"Glue job {job.name} have logging enabled."

            findings.append(report)

        return findings

References