class DataCatalogEncryptionAtRest 🔹

Language	Type name
.NET	Amazon.CDK.AWS.Glue.Alpha.DataCatalogEncryptionAtRest
Go	github.com/aws/aws-cdk-go/awscdkgluealpha/v2#DataCatalogEncryptionAtRest
Java	software.amazon.awscdk.services.glue.alpha.DataCatalogEncryptionAtRest
Python	aws_cdk.aws_glue_alpha.DataCatalogEncryptionAtRest
TypeScript (source)	@aws-cdk/aws-glue-alpha » DataCatalogEncryptionAtRest

Encryption-at-rest configuration for a Glue Data Catalog.

The Data Catalog encryption at rest and the connection password encryption are independent: enabling one does not require the other, and each may use a different KMS key.

See also: https://docs.aws.amazon.com/glue/latest/webapi/API_EncryptionAtRest.html

Example

import * as iam from 'aws-cdk-lib/aws-iam';
declare const key: kms.Key;
declare const role: iam.IRole;
glue.Catalog.encryptAccount(this, {
  encryptionAtRest: glue.DataCatalogEncryptionAtRest.kmsWithServiceRole(role, key),
});

Properties

Name	Type	Description
mode🔹	CatalogEncryptionMode	The encryption mode.
kmsKey?🔹	IKeyRef	The customer-managed KMS key used for encryption at rest, if any.
serviceRole?🔹	IRole	The service role that AWS Glue assumes to access the KMS key, if any.

---

mode🔹

Type: CatalogEncryptionMode

The encryption mode.

---

kmsKey?🔹

Type: IKeyRef (optional)

The customer-managed KMS key used for encryption at rest, if any.

---

serviceRole?🔹

Type: IRole (optional)

The service role that AWS Glue assumes to access the KMS key, if any.

Methods

Name	Description
static disabled()🔹	Disable encryption at rest for the Data Catalog.
static kms(key?)🔹	Encrypt the Data Catalog at rest with an AWS KMS key.
static kmsWithServiceRole(role, key?)🔹	Encrypt the Data Catalog at rest with an AWS KMS key, accessed through a service role that AWS Glue assumes on your behalf.

---

static disabled()🔹

public static disabled(): DataCatalogEncryptionAtRest

Returns

• DataCatalogEncryptionAtRest

Disable encryption at rest for the Data Catalog.

---

static kms(key?)🔹

public static kms(key?: IKey): DataCatalogEncryptionAtRest

Parameters

• key IKey — the KMS key to use.

Returns

• DataCatalogEncryptionAtRest

Encrypt the Data Catalog at rest with an AWS KMS key.

---

static kmsWithServiceRole(role, key?)🔹

public static kmsWithServiceRole(role: IRole, key?: IKey): DataCatalogEncryptionAtRest

Parameters

• role IRole — the service role that AWS Glue assumes to access the key.
• key IKey — the KMS key to use.

Returns

• DataCatalogEncryptionAtRest

Encrypt the Data Catalog at rest with an AWS KMS key, accessed through a service role that AWS Glue assumes on your behalf.

When a customer-managed key is provided, the role is automatically granted kms:Encrypt/kms:Decrypt/kms:GenerateDataKey* on it.