Glue Data Catalog and connection-password responses should be protected

What it checks

Glue Data Catalog encryption settings: review metadata encryption and connection-password response protection.

Where it applies

Terraform: aws_glue_data_catalog_encryption_settings

CloudFormation: AWS::Glue::DataCatalogEncryptionSettings

How to fix it

1. For a missing or DISABLED catalog encryption mode, configure the existing Terraform encryption_at_rest.catalog_encryption_mode or CloudFormation EncryptionAtRest.CatalogEncryptionMode with an appropriate supported encryption mode and key permissions. Preserve unrelated account-and-Region-wide settings.
2. For an explicit false response flag, review the existing connection_password_encryption.return_connection_password_encrypted or CloudFormation ConnectionPasswordEncryption.ReturnConnectionPasswordEncrypted and enable encrypted GetConnection/GetConnections responses. A password key is optional in the API; when supplying one, review CreateConnection/UpdateConnection kms:Encrypt and reader decrypt permissions. Encryption of stored passwords depends on connection creation/update configuration; review existing connections rather than assuming this flag reencrypts old credentials.

Frameworks

• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules