AWS Glue component is not associated with a security configuration misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_195
Category - Subcategory	Storage - Permissions
Provider	AWS
Severity	LOW
Framework	CloudFormation, Terraform

Impact

This rule ensures that AWS Glue components (Crawlers, DevEndpoints, and Jobs) have a security configuration associated. Associating a security configuration with Glue components helps ensure the security of data in transit and at rest, which is critical for maintaining data integrity and protecting sensitive information. This rule checks whether the CrawlerSecurityConfiguration or SecurityConfiguration property is configured appropriately for Glue components.

How to Fix

To fix this issue, ensure that the appropriate security configuration properties are set for your Glue components.

Example for a Glue Crawler:

Example for a Glue DevEndpoint:

Example for a Glue Job: [source,go]

Resources: MyGlueCrawler: Type: AWS::Glue::Crawler Properties: Name: example-crawler Role: arn:aws:iam::123456789012:role/glue-role DatabaseName: example-database Targets: ... CrawlerSecurityConfiguration: example-security-configuration ...

Resources: MyGlueDevEndpoint: Type: AWS::Glue::DevEndpoint Properties: EndpointName: example-dev-endpoint RoleArn: arn:aws:iam::123456789012:role/glue-role SecurityConfiguration: example-security-configuration ...

Resources: MyGlueJob: Type: AWS::Glue::Job Properties: Name: example-job Role: arn:aws:iam::123456789012:role/glue-role Command: ... SecurityConfiguration: example-security-configuration ...