# Ensure Glue ETL Jobs have Job bookmark encryption enabled

- Source: https://support.icompaas.com/support/solutions/articles/62000229533-ensure-glue-etl-jobs-have-job-bookmark-encryption-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Policy Updates](https://support.icompaas.com/support/solutions/folders/62000168784)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**  
AWS Glue ETL jobs can store job bookmarks, which are files that contain information about the state of a job. Enabling encryption for job bookmarks helps to protect them from unauthorized access.

**Rationale:**  
Job bookmarks can contain sensitive information, such as the names of the tables that were processed by a job or the values of the parameters that were passed to a job. If these bookmarks are not encrypted, they could be easily compromised, which could lead to unauthorized access to sensitive data.

**Impact:**  
If job bookmarks are not encrypted, then they could be easily compromised. This could lead to unauthorized access to sensitive data, such as customerPII, financial data, and intellectual property.

**Default Value:**  
AWS Glue does not enable encryption for job bookmarks by default.

**Pre-requisites:**

-   You must have an AWS account and be logged in to the AWS Management Console.
-   You must have the AWS CLI installed and configured.

  

**Remediation Steps:**

-   Sign in to the AWS Management Console.
-   Go to the AWS Glue console.
-   Click **Jobs** in the left navigation pane.
-   Select the job that you want to enable encryption for.
-   On the **Job details** page, click the **Configuration** tab.
-   In the **Job bookmark encryption** section, select the **Enable job bookmark encryption** checkbox.
-   Select the AWS KMS key that you want to use for encryption.
-   Click **Save**.

  

**Test Plan:**

-   Verify that the **Enable job bookmark encryption** checkbox is selected.
-   Verify that the AWS KMS key that you selected is the correct key.
-   Try to access the job bookmarks for the job using the AWS CLI.
-   If you are unable to access the bookmarks, then they are encrypted.

**Implementation Plan:**

**AWS CLI Process:**

-   Run the following command to enable encryption for job bookmarks:

aws glue create-job --region us-east-1 --job-name my-job --enable-job-bookmark-encryption true --kms-key-id arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012

**Using AWS GUI:**

-   Go to the AWS Glue console.
-   Click **Jobs** in the left navigation pane.
-   Select the job that you want to enable encryption for.
-   On the **Job details** page, click the **Configuration** tab.
-   In the **Job bookmark encryption** section, select the **Enable job bookmark encryption** checkbox.
-   Select the AWS KMS key that you want to use for encryption.
-   Click **Save**.

  

**Backout Plan:**

-   Sign in to the AWS Management Console.
-   Go to the AWS Glue console.
-   Click **Jobs** in the left navigation pane.
-   Select the job that you want to disable encryption for.
-   On the **Job details** page, click the **Configuration** tab.
-   In the **Job bookmark encryption** section, unselect the **Enable job bookmark encryption** checkbox.
-   Click **Save**.

  

**Note:**

-   This policy only applies to job bookmarks for AWS Glue ETL jobs. Other job bookmarks may not be encrypted.
-   You can also enable encryption for job bookmarks using the AWS Glue API.
-   For more information, see the AWS Glue documentation on encrypting job bookmarks: [https://docs.aws.amazon.com/glue/latest/dg/encryption-at-rest.html](https://docs.aws.amazon.com/glue/latest/dg/encryption-at-rest.html).

  

**Reference:**

[https://docs.aws.amazon.com/glue/latest/dg/encryption-at-rest.html](https://docs.aws.amazon.com/glue/latest/dg/encryption-at-rest.html)

[https://docs.aws.amazon.com/kms/latest/developerguide/](https://docs.aws.amazon.com/kms/latest/developerguide/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.