All checks
Medium
AWS Glue machine learning transforms should be encrypted at rest
Checks that the Glue machine learning transform encrypts its user data, the model and labels, with SSE-KMS; a transform with ML user data encryption disabled fails. Encrypting them keeps someone who can reach the stored data from inspecting the model or the labelled records it was taught with.
- service
- Glue
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Replaces the resource: Encryption is set only when a transform is created, so create one with SSE-KMS, import this one's exported labels and retrain it, point jobs at its ID, then delete this one.
In the console
AWS Glue → Data classification tools → Record Matching → Create transform → Set transform properties
- Server-side encryption with AWS KMS (SSE-KMS)
- Selected
- AWS KMS key
- A KMS key by name, or Enter a key ARN
With the AWS CLI
aws glue create-ml-transform --name <new-transform-name> --input-record-tables DatabaseName=<database-name>,TableName=<table-name> --parameters 'TransformType=FIND_MATCHES,FindMatchesParameters={PrimaryKeyColumnName=<primary-key-column>}' --role <role-arn> --transform-encryption 'MlUserDataEncryption={MlUserDataEncryptionMode=SSE-KMS,KmsKeyId=<kms-key-id>}' --region <region>See which of your accounts this check is failing on.
Book a live scan