Encrypting your Data Catalog

To enable encryption using the console

1. Sign in to the AWS Management Console and open the AWS Glue console at https://console.aws.amazon.com/glue/.

2. Choose Data Catalog in the navigation pane.

3. On the Data Catalog settings page, select the Metadata encryption check box, and choose an AWS KMS key.

   When you enable encryption, if you don’t specify a customer managed key, the encryption settings use an AWS managed KMS key.

4. (Optional) When you use a customer managed key to encrypt your Data Catalog, the Data Catalog provides an option to register an IAM role to encrypt and decrypt resources. You need to grant your IAM role permissions that AWS Glue can assume on your behalf. This includes AWS KMS permissions to encrypt and decrypt data.

   When you create a new resource in the Data Catalog, AWS Glue assumes the IAM role that's provided to encrypt the data. Similarly, when a consumer accesses the resource, AWS Glue assumes the IAM role to decrypt data. If you register an IAM role with the required permissions, the calling principal no longer requires permissions to access the key and decrypt the data.

   Important

   You can delegate KMS operations to an IAM role only when you use a customer managed key to encrypt the Data Catalog resources. KMS role delegation feature doesn't support using AWS managed keys for encrypting Data Catalog resources at this time.

   Warning

   When you enable an IAM role to delegate KMS operations, you can no longer access the Data Catalog resources that were encrypted previously with an AWS managed key.

   1. To enable an IAM role that AWS Glue can assume to encrypt and decrypt data on your behalf, select the Delegate KMS operations to an IAM role option.

   2. Next, choose an IAM role.

      To create an IAM role, see Create an IAM role for AWS Glue.

      The IAM role that AWS Glue assumes to access the Data Catalog must have the permissions to encrypt and decrypt metadata in the Data Catalog. You can create an IAM role, and attach the following inline policies:

      • Add the following policy to include AWS KMS permissions to encrypt and decrypt the Data Catalog.

        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Action": [
                        "kms:Decrypt",
                        "kms:Encrypt",
                        "kms:GenerateDataKey"
                    ],
                    "Resource": "arn:aws:kms:<region>:<account-id>:key/<key-id>"
                }
            ]
        }                   
                          

      • Next, add the following trust policy to the role for AWS Glue service to assume the IAM role.

        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Sid": "",
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "glue.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                }
            ]
         }

      • Next, add the iam:PassRole permission to the IAM role.

        
                                { 
            "Version": "2012-10-17", 
            "Statement": [ 
                { 
                    "Effect": "Allow", 
                    "Action": [ 
                        "iam:PassRole" 
                    ], 
                    "Resource": [ 
                        "arn:aws:iam::<account-id>:role/<encryption-role-name>" 
                    ] 
                } 
            ] 
        }           
                              

   When you enable encryption, if you haven't specified an IAM role for AWS Glue to assume, the principal accessing the Data Catalog must have permissions to perform the following API operations:

   • kms:Decrypt

   • kms:Encrypt

   • kms:GenerateDataKey

To enable encryption using the SDK or AWS CLI

• Use the PutDataCatalogEncryptionSettings API operation. If no key is specified, AWS Glue uses AWS managed encryption key for the customer account to encrypt the Data Catalog.

  aws glue put-data-catalog-encryption-settings \
    --data-catalog-encryption-settings '{
        "EncryptionAtRest": {
        "CatalogEncryptionMode": "SSE-KMS-WITH-SERVICE-ROLE",
        "SseAwsKmsKeyId": "arn:aws:kms:<region>:<account-id>:key/<key-id>",
        "CatalogEncryptionServiceRole":"arn:aws:iam::<account-id>:role/<encryption-role-name>"
      }
  
    }'