Encrypting your Data Catalog

To enable encryption using the console

1. Sign in to the Amazon Web Services Management Console and open the Amazon Glue console at https://console.amazonaws.cn/glue/.

2. Choose Data Catalog in the navigation pane.

3. On the Data Catalog settings page, select the Metadata encryption check box, and choose an Amazon KMS key.

   When you enable encryption, if you don’t specify a customer managed key, the encryption settings use an Amazon managed KMS key.

4. (Optional) When you use a customer managed key to encrypt your Data Catalog, the Data Catalog provides an option to register an IAM role to encrypt and decrypt resources. You need to grant your IAM role permissions that Amazon Glue can assume on your behalf. This includes Amazon KMS permissions to encrypt and decrypt data.

   When you create a new resource in the Data Catalog, Amazon Glue assumes the IAM role that's provided to encrypt the data. Similarly, when a consumer accesses the resource, Amazon Glue assumes the IAM role to decrypt data. If you register an IAM role with the required permissions, the calling principal no longer requires permissions to access the key and decrypt the data.

   Important

   You can delegate KMS operations to an IAM role only when you use a customer managed key to encrypt the Data Catalog resources. KMS role delegation feature doesn't support using Amazon managed keys for encrypting Data Catalog resources at this time.

   Warning

   When you enable an IAM role to delegate KMS operations, you can no longer access the Data Catalog resources that were encrypted previously with an Amazon managed key.

   1. To enable an IAM role that Amazon Glue can assume to encrypt and decrypt data on your behalf, select the Delegate KMS operations to an IAM role option.

   2. Next, choose an IAM role.

      To create an IAM role, see Create an IAM role for Amazon Glue.

      The IAM role that Amazon Glue assumes to access the Data Catalog must have the permissions to encrypt and decrypt metadata in the Data Catalog. You can create an IAM role, and attach the following inline policies:

      • Add the following policy to include Amazon KMS permissions to encrypt and decrypt the Data Catalog.

        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Action": [
                        "kms:Decrypt",
                        "kms:Encrypt",
                        "kms:GenerateDataKey"
                    ],
                    "Resource": "arn:aws:kms:<region>:<account-id>:key/<key-id>"
                }
            ]
        }                   
                          

      • Next, add the following trust policy to the role for Amazon Glue service to assume the IAM role.

        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Sid": "",
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "glue.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                }
            ]
         }

      • Next, add the iam:PassRole permission to the IAM role.

        
                                { 
            "Version": "2012-10-17", 
            "Statement": [ 
                { 
                    "Effect": "Allow", 
                    "Action": [ 
                        "iam:PassRole" 
                    ], 
                    "Resource": [ 
                        "arn:aws:iam::<account-id>:role/<encryption-role-name>" 
                    ] 
                } 
            ] 
        }           
                              

   When you enable encryption, if you haven't specified an IAM role for Amazon Glue to assume, the principal accessing the Data Catalog must have permissions to perform the following API operations:

   • kms:Decrypt

   • kms:Encrypt

   • kms:GenerateDataKey

To enable encryption using the SDK or Amazon CLI

• Use the PutDataCatalogEncryptionSettings API operation. If no key is specified, Amazon Glue uses Amazon managed encryption key for the customer account to encrypt the Data Catalog.

  aws glue put-data-catalog-encryption-settings \
    --data-catalog-encryption-settings '{
        "EncryptionAtRest": {
        "CatalogEncryptionMode": "SSE-KMS-WITH-SERVICE-ROLE",
        "SseAwsKmsKeyId": "arn:aws:kms:<region>:<account-id>:key/<key-id>",
        "CatalogEncryptionServiceRole":"arn:aws:iam::<account-id>:role/<encryption-role-name>"
      }
  
    }'