DataCatalogEncryptionAtRest

class aws_cdk.aws_glue_alpha.DataCatalogEncryptionAtRest(*args: Any, **kwargs)

Bases: object

(experimental) Encryption-at-rest configuration for a Glue Data Catalog.

The Data Catalog encryption at rest and the connection password encryption are independent: enabling one does not require the other, and each may use a different KMS key.

See:: https://docs.aws.amazon.com/glue/latest/webapi/API_EncryptionAtRest.html
Stability:: experimental
ExampleMetadata:: infused

Example:

import aws_cdk.aws_iam as iam
# key: kms.Key
# role: iam.IRole

glue.Catalog.encrypt_account(self,
    encryption_at_rest=glue.DataCatalogEncryptionAtRest.kms_with_service_role(role, key)
)

Attributes

kms_key

(experimental) The customer-managed KMS key used for encryption at rest, if any.

Stability:: experimental

mode

(experimental) The encryption mode.

Stability:: experimental

service_role

(experimental) The service role that AWS Glue assumes to access the KMS key, if any.

Stability:: experimental

Static Methods

classmethod disabled()

(experimental) Disable encryption at rest for the Data Catalog.

Stability:: experimental
Return type:: DataCatalogEncryptionAtRest

classmethod kms(key=None)

(experimental) Encrypt the Data Catalog at rest with an AWS KMS key.

Parameters:: key (Optional[IKey]) – the KMS key to use. If omitted, an AWS-managed key is used and the key is not exposed as a grantable resource.
Stability:: experimental
Return type:: DataCatalogEncryptionAtRest

classmethod kms_with_service_role(role, key=None)

(experimental) Encrypt the Data Catalog at rest with an AWS KMS key, accessed through a service role that AWS Glue assumes on your behalf.

When a customer-managed key is provided, the role is automatically granted kms:Encrypt/kms:Decrypt/kms:GenerateDataKey* on it.

Parameters:

role (IRole) – the service role that AWS Glue assumes to access the key.
key (Optional[IKey]) – the KMS key to use. If omitted, an AWS-managed key is used and the key is not exposed as a grantable resource.

Stability:

experimental

Return type:

DataCatalogEncryptionAtRest