AWS CDK Reference

Appearance

v2.274.0

DataCatalogEncryptionAtRest Class ​

Encryption-at-rest configuration for a Glue Data Catalog.

The Data Catalog encryption at rest and the connection password encryption are independent: enabling one does not require the other, and each may use a different KMS key.

Source
lib/catalog.ts
Type last changed
v2.270.0-alpha.0 · 18 Sep 2026

Example ​

ts
import * as iam from 'aws-cdk-lib/aws-iam';
declare const key: kms.Key;
declare const role: iam.IRole;
glue.Catalog.encryptAccount(this, {
  encryptionAtRest: glue.DataCatalogEncryptionAtRest.kmsWithServiceRole(role, key),
});

Properties ​

kmsKeymay be undefinedIKeyRefkms_keymay be undefinedIKeyRefkmsKeymay be undefinedIKeyRefKmsKeymay be undefinedIKeyRefKmsKeymay be undefinedIKeyRef#
The customer-managed KMS key used for encryption at rest, if any.
serviceRolemay be undefinedIRoleservice_rolemay be undefinedIRoleserviceRolemay be undefinedIRoleServiceRolemay be undefinedIRoleServiceRolemay be undefinedIRole#
The service role that AWS Glue assumes to access the KMS key, if any.

Methods ​

disabled(): DataCatalogEncryptionAtRest // chainable@staticmethod def disabled() -> DataCatalogEncryptionAtRestpublic static DataCatalogEncryptionAtRest disabled()public static DataCatalogEncryptionAtRest Disabled()func Disabled() DataCatalogEncryptionAtReststatic#
Disable encryption at rest for the Data Catalog.
kms(key?: IKeyRef): DataCatalogEncryptionAtRest // chainable@staticmethod def kms(key: typing.Optional[IKeyRef] = None) -> DataCatalogEncryptionAtRestpublic static DataCatalogEncryptionAtRest kms(IKeyRef key)public static DataCatalogEncryptionAtRest Kms(IKeyRef? key = null)func Kms(Key IKeyRef) DataCatalogEncryptionAtReststatic#
Encrypt the Data Catalog at rest with an AWS KMS key.
1 parameter

Parameters

  • keykeykeykeyKey — the KMS key to use.
kmsWithServiceRole(role: IRole, key?: IKeyRef): DataCatalogEncryptionAtRest // chainable@staticmethod def kms_with_service_role(role: IRole, key: typing.Optional[IKeyRef] = None) -> DataCatalogEncryptionAtRestpublic static DataCatalogEncryptionAtRest kmsWithServiceRole(IRole role, IKeyRef key)public static DataCatalogEncryptionAtRest KmsWithServiceRole(IRole role, IKeyRef? key = null)func KmsWithServiceRole(Role IRole, Key IKeyRef) DataCatalogEncryptionAtReststatic#
Encrypt the Data Catalog at rest with an AWS KMS key, accessed through a service role that AWS Glue assumes on your behalf.

When a customer-managed key is provided, the role is automatically granted kms:Encrypt/kms:Decrypt/kms:GenerateDataKey* on it.

2 parameters

Parameters

  • roleroleroleroleRole — the service role that AWS Glue assumes to access the key.
  • keykeykeykeyKey — the KMS key to use.