Question

A data engineering team stores JDBC connection definitions in the AWS Glue Data Catalog to allow Glue jobs to reach an on-premises database. A security audit requires that the database credentials embedded in these connections not be stored in plaintext within Glue, and that any encryption keys be centrally managed and auditable. Which action best satisfies this requirement?

Accepted Answer

Enable connection password encryption in the Glue Data Catalog settings using a customer managed AWS KMS key

Answer

Enable server-side encryption on the S3 bucket that stores Glue job scripts using SSE-S3

Answer

Attach an IAM policy to the Glue job role that denies read access to the connection object

Answer

Store the connection credentials in a Glue job argument passed at runtime and enable job bookmarks