Job Bookmark Encryption Mode

01 Sign in to AWS Management Console.

02 Navigate to Glue service dashboard at https://console.aws.amazon.com/glue/.

03 In the left navigation panel, under Security, choose Security configurations.

04 Select the security configuration that you want to examine, then click on the resource name (link) to access its configuration details page.

05 On the security configuration details page, check the Job bookmark encryption mode feature status. If the status is set to DISABLED, the selected security configuration is not compliant and the Amazon Glue job bookmark data is not encrypted at rest.

06 Repeat step no. 4 and 5 to verify other Amazon Glue security configurations created in the current region.

07 Change the AWS region from the console navigation bar and repeat the audit process for other regions.

01 Run get-security-configurations command (OSX/Linux/UNIX) to retrieve the names of all Amazon Glue security configurations available in the specified AWS region:

aws glue get-security-configurations
	--region us-east-1
	--output table
	--query 'SecurityConfigurations[*].Name'

02 The command output should return a table with AWS Glue security configuration names:

-------------------------------
|  GetSecurityConfigurations  |
+-----------------------------+
|  cc-glue-security-config    |
|  cc-security-configuration  |
|  cc-project5-sec-config     |
+-----------------------------+

03 Execute get-security-configuration command (OSX/Linux/UNIX) using the name of the AWS Glue security configuration that you want to examine as identifier and custom query filters to retrieve the Amazon Glue job bookmark encryption mode status:

aws glue get-security-configuration
	--name cc-glue-security-config
	--region us-east-1
	--query 'SecurityConfiguration.EncryptionConfiguration.JobBookmarksEncryption.JobBookmarksEncryptionMode'

04 The command output should return the requested configuration information:

"DISABLED"

05 Repeat step no. 3 and 4 to check other Amazon Glue security configurations available in the selected region.

06 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 5 to perform the entire audit process for other regions.

01 Sign in to AWS Management Console.

02 Navigate to Glue service dashboard at https://console.aws.amazon.com/glue/.

03 In the left navigation panel, under Security, select Security configurations.

04 Click Add security configuration to start the setup process.

05 On Add security configuration page, perform the following:

1. In the Security configuration name box, type a unique name for your new Glue security configuration.
2. Click the Advanced properties tab and select Job bookmark encryption checkbox to enable encryption at-rest for your Amazon Glue job bookmarks, then choose the ARN of the AWS KMS key that you want to use from AWS KMS key dropdown list.
3. Ensure that S3 encryption and CloudWatch logs encryption settings are enabled, then click Finish to create your new Amazon Glue security configuration.

06 Update the configuration of your existing AWS Glue ETL jobs to make use of the new security configuration created at the previous step.

07 Change the AWS region from the navigation bar and repeat the process for other regions.

01 Define the security configuration parameters and save the document to a JSON file named sec-config-bookmarks-encrypted.json. Replace "KmsKeyArn" parameter value (highlighted) with the ARN of your own AWS KMS key:

{
  "JobBookmarksEncryption": {
    "JobBookmarksEncryptionMode": "CSE-KMS",
    "KmsKeyArn": "arn:aws:kms:us-east-1:123456789012:key/1234abcd-1234-abcd-1234-abcd1234abcd"
  },
  "S3Encryption": [
    {
      "S3EncryptionMode": "DISABLED"
    }
  ],
  "CloudWatchEncryption": {
    "CloudWatchEncryptionMode": "DISABLED"
  }
} 

02 Run create-security-configuration command (OSX/Linux/UNIX) using the sec-config-bookmarks-encrypted.json file created at the previous step as value for the --encryption-configuration parameter, to create a new Amazon Glue security configuration that has AWS Glue job bookmark encryption mode enabled:

aws glue create-security-configuration
	--region us-east-1
	--name cc-updated-sec-configuration
	--encryption-configuration file://sec-config-bookmarks-encrypted.json

03 The command output should return the command request metadata:

{
    "CreatedTimestamp": 1548339022.188,
    "Name": "cc-updated-sec-configuration"
}

04 Update your existing Amazon Glue ETL jobs configuration to make use of the new AWS Glue security configuration created earlier in the process.

05 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 4 to perform the entire process for other regions.