# DataCatalogEncryptionAtRest

Encryption-at-rest configuration for a Glue Data Catalog.

The Data Catalog encryption at rest and the connection password encryption
are independent: enabling one does not require the other, and each may use a
different KMS key.

- Source: [`lib/catalog.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0-alpha.0/packages/@aws-cdk/aws-glue-alpha/lib/catalog.ts#L45)
- Type last changed: v2.270.0-alpha.0 · 18 Sep 2026

## Example

```ts
import * as iam from 'aws-cdk-lib/aws-iam';
declare const key: kms.Key;
declare const role: iam.IRole;
glue.Catalog.encryptAccount(this, {
  encryptionAtRest: glue.DataCatalogEncryptionAtRest.kmsWithServiceRole(role, key),
});
```

## Properties

- `kmsKey`: [IKeyRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_kms.IKeyRef.html) — The customer-managed KMS key used for encryption at rest, if any.

- `mode`: [CatalogEncryptionMode](/cdk/api/v2/docs/@aws-cdk_aws-glue-alpha.CatalogEncryptionMode.html) (required) — The encryption mode.

- `serviceRole`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — The service role that AWS Glue assumes to access the KMS key, if any.

## Methods

- `disabled(): DataCatalogEncryptionAtRest // chainable` (static) — Disable encryption at rest for the Data Catalog.

- `kms(key?: IKeyRef): DataCatalogEncryptionAtRest // chainable` (static) — Encrypt the Data Catalog at rest with an AWS KMS key.

  **Parameters**

  - `key` — the KMS key to use.

- `kmsWithServiceRole(role: IRole, key?: IKeyRef): DataCatalogEncryptionAtRest // chainable` (static) — Encrypt the Data Catalog at rest with an AWS KMS key, accessed through a service role that AWS Glue assumes on your behalf.

  When a customer-managed `key` is provided, the `role` is automatically
  granted `kms:Encrypt`/`kms:Decrypt`/`kms:GenerateDataKey*` on it.

  **Parameters**

  - `role` — the service role that AWS Glue assumes to access the key.
  - `key` — the KMS key to use.