Glue connection password should not be a plaintext literal

What it checks

Glue connection: connection PASSWORD appears to be a literal credential in the IaC source and its state or stack.

Where it applies

Terraform: aws_glue_connection

CloudFormation: AWS::Glue::Connection

How to fix it

1. Move the connection password to Secrets Manager. Reference the secret version in connection_properties.PASSWORD.
2. Enable connection_password_encryption before creating or updating connections in this account and Region (order dependencies accordingly). Set return_connection_password_encrypted to protect GetConnection responses; re-create/update older connections as needed.

Frameworks

• SOC 2 CC6.1

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules