# Encrypting connection passwords
<a name="encrypt-connection-passwords"></a>

You can retrieve connection passwords in the Amazon Glue Data Catalog by using the `GetConnection` and `GetConnections` API operations. These passwords are stored in the Data Catalog connection and are used when Amazon Glue connects to a Java Database Connectivity (JDBC) data store. When the connection was created or updated, an option in the Data Catalog settings determined whether the password was encrypted, and if so, what Amazon Key Management Service (Amazon KMS) key was specified.

On the Amazon Glue console, you can turn on this option on the **Data catalog settings** page.

**To encrypt connection passwords**

1. Sign in to the Amazon Web Services Management Console and open the Amazon Glue console at [https://console.amazonaws.cn/glue/](https://console.amazonaws.cn/glue/).

1. Choose **Settings** in the navigation pane. 

1. On the **Data catalog settings** page, select **Encrypt connection passwords**, and choose an Amazon KMS key.
**Important**  
Amazon Glue supports only symmetric customer master keys (CMKs). The **Amazon KMS key** list displays only symmetric keys. However, if you select **Choose a Amazon KMS key ARN**, the console lets you enter an ARN for any key type. Ensure that you enter only ARNs for symmetric keys.

   For more information, see [Data Catalog settings](console-data-catalog-settings.md).