ENCRYPT - Amazon Glue DataBrew
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

ENCRYPT

Encrypts values in the source columns with the Amazon Encryption SDK. The DECRYPT transform can be used to decrypt inside of DataBrew. You can also decrypt the data outside of DataBrew using the Amazon Encryption SDK.

The ENCRYPT transform can encrypt up to 128 MiB per cell. It will attempt to preserve the format on decryption. To preserve the data type, the data type metadata must serialize to less than 1KB. Otherwise, you must set the preserveDataType parameter to false. The data type metadata will be stored in plaintext in the encryption context. For more information on the encryption context, see Encryption context in the Amazon Key Management Service Developer Guide.

Parameters

  • sourceColumns – An array of existing columns.

  • kmsKeyArn – The key ARN of the Amazon Key Management Service key to use to encrypt the source columns. For more information on the key ARN, see Key ARN in the Amazon Key Management Service Developer Guide.

  • entityTypeFilter – Optional array of entity types. Can be used to encrypt only detected PII in free-text column.

  • preserveDataType – Optional boolean. Defaults to true. If false, the data type will not be stored.

In the following example, entityTypeFilter and preserveDataType are optional.

Example

{
    "sourceColumns": ["phonenumber"],
    "kmsKeyArn": "arn:aws:kms:us-east-1:012345678901:key/kms-key-id",
    "entityTypeFilter": ["USA_ALL"],
    "preserveDataType": "true"
}

When working in the interactive experience, in addition to the project’s role, the console user must have permission to kms:GenerateDataKey on the provided Amazon KMS key.

Sample policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "kms:GenerateDataKey"
        ],
        "Resource": [
            "arn:aws:kms:us-east-1:012345678901:key/kms-key-id"
        ]
    }
  ]
}