Back to Checks
aws

Glue ML Transform is encrypted at rest

glue_ml_transform_encrypted_at_rest
Service: glueSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Other

AWS Glue ML transforms are evaluated for encryption at rest of transform user data using KMS keys. The finding highlights transforms where encryption is not configured.

Prowler logoProwlerprowler-provider-aws

Risk

Without encryption, confidentiality is weakened: transform artifacts, mappings, and sample datasets may be readable via storage access, backups, or cross-account exposure. This can lead to data disclosure and aid lateral movement by revealing schemas and data relationships.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks glue_ml_transform_encrypted_at_rest

Recommendation

Enable KMS-backed encryption at rest for all ML transforms and prefer customer-managed keys.

  • Apply least privilege key policies and rotate keys
  • Enforce defense in depth with network and IAM controls
  • Monitor key usage and transform access with audit logs

Remediation

CLI

aws glue update-ml-transform --transform-id <transform-id> --transform-encryption '{"MlUserDataEncryption":{"MlUserDataEncryptionMode":"SSE-KMS","KmsKeyId":"<kms-key-arn>"}}'

Terraform

resource "aws_glue_ml_transform" "<example_resource_name>" {
  name     = "<example_resource_name>"
  role_arn = "<example_resource_id>"

  input_record_tables {
    database_name = "<example_resource_name>"
    table_name    = "<example_resource_name>"
  }

  parameters {
    transform_type = "FIND_MATCHES"
    find_matches_parameters {
      primary_key_column_name = "<example_resource_name>"
    }
  }

  transform_encryption {
    ml_user_data_encryption {
      ml_user_data_encryption_mode = "SSE-KMS"   # Critical: enables encryption at rest
      kms_key_id                   = "<kms-key-arn>" # Critical: KMS key used for encryption
    }
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::Glue::MLTransform
    Properties:
      Role: <example_resource_id>
      InputRecordTables:
        - DatabaseName: <example_resource_name>
          TableName: <example_resource_name>
      TransformParameters:
        TransformType: FIND_MATCHES
        FindMatchesParameters:
          PrimaryKeyColumnName: <example_resource_name>
      TransformEncryption:
        MlUserDataEncryption:
          MlUserDataEncryptionMode: SSE-KMS  # Critical: enables ML user data encryption at rest
          KmsKeyId: <kms-key-arn>            # Critical: KMS key used for encryption

Other

1In the AWS Management Console, open AWS Glue
2Go to Machine learning > Transforms and select the target transform
3Click Edit
4Under Encryption, enable ML user data encryption
5Choose an AWS KMS key
6Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.glue.glue_client import glue_client


class glue_ml_transform_encrypted_at_rest(Check):
    def execute(self):
        findings = []

        for ml_transform in glue_client.ml_transforms.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=ml_transform)
            report.status = "PASS"
            report.status_extended = (
                f"Glue ML Transform {ml_transform.name} is encrypted at rest."
            )

            if ml_transform.user_data_encryption == "DISABLED":
                report.status = "FAIL"
                report.status_extended = (
                    f"Glue ML Transform {ml_transform.name} is not encrypted at rest."
                )

            findings.append(report)

        return findings

References