Glue security configuration should encrypt S3 data at rest

What it checks

Glue security configuration: Glue-managed S3 encryption is disabled.

Where it applies

Terraform: aws_glue_security_configuration

CloudFormation: AWS::Glue::SecurityConfiguration

How to fix it

1. Set encryption_configuration.s3_encryption.s3_encryption_mode = "SSE-KMS" with a kms_key_arn, or choose SSE-S3 without a KMS key. Attach this security configuration to the jobs/crawlers it protects.

Frameworks

• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules