Repository: cloud-custodian/cloud-custodian

Issue:
aws glue-connections hide password
**Is your feature request related to a problem? Please describe.**
When running a policy on `resource: glue-connection` the api returns a password as part of metadata. 

**Describe the solution you'd like**
Set `HidePassword=True` while making the api call https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/glue.html#Glue.Client.get_connections

**Describe alternatives you've considered**
A clear and concise description of any alternative solutions or features you've considered.

**Additional context**
Add any other context or screenshots about the feature request here.



Discussion:
sounds good

Resolving patch:
diff --git a/c7n/resources/glue.py b/c7n/resources/glue.py
--- a/c7n/resources/glue.py
+++ b/c7n/resources/glue.py
@@ -22,7 +22,7 @@ class GlueConnection(QueryResourceManager):
 
     class resource_type(TypeInfo):
         service = 'glue'
-        enum_spec = ('get_connections', 'ConnectionList', None)
+        enum_spec = ('get_connections', 'ConnectionList', {'HidePassword': True})
         id = name = 'Name'
         date = 'CreationTime'
         arn_type = "connection"


Test patch:
diff --git a/tests/data/placebo/test_connection_password_hidden/glue.GetConnections_1.json b/tests/data/placebo/test_connection_password_hidden/glue.GetConnections_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_connection_password_hidden/glue.GetConnections_1.json
@@ -0,0 +1,44 @@
+{
+    "status_code": 200,
+    "data": {
+        "ConnectionList": [
+            {
+                "Name": "test",
+                "ConnectionType": "JDBC",
+                "ConnectionProperties": {
+                    "JDBC_CONNECTION_URL": "jdbc:mysql://database-3-instance-1.cz6wy8cci3uf.us-east-1.rds.amazonaws.com:3306/test",
+                    "JDBC_ENFORCE_SSL": "false",
+                    "USERNAME": "admin"
+                },
+                "PhysicalConnectionRequirements": {
+                    "SubnetId": "subnet-3a334610",
+                    "SecurityGroupIdList": [
+                        "sg-6c7fa917"
+                    ],
+                    "AvailabilityZone": "us-east-1d"
+                },
+                "CreationTime": {
+                    "__class__": "datetime",
+                    "year": 2020,
+                    "month": 5,
+                    "day": 4,
+                    "hour": 17,
+                    "minute": 1,
+                    "second": 0,
+                    "microsecond": 856000
+                },
+                "LastUpdatedTime": {
+                    "__class__": "datetime",
+                    "year": 2021,
+                    "month": 5,
+                    "day": 4,
+                    "hour": 17,
+                    "minute": 1,
+                    "second": 0,
+                    "microsecond": 856000
+                }
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/test_glue.py b/tests/test_glue.py
--- a/tests/test_glue.py
+++ b/tests/test_glue.py
@@ -71,6 +71,19 @@ def test_connection_delete(self):
         connections = client.get_connections()["ConnectionList"]
         self.assertFalse(connections)
 
+    def test_connection_password_hidden(self):
+        session_factory = self.replay_flight_data("test_connection_password_hidden")
+        p = self.load_policy(
+            {
+                "name": "glue-connection",
+                "resource": "glue-connection",
+            },
+            session_factory=session_factory,
+        )
+        resources = p.run()
+        self.assertEqual(len(resources), 1)
+        self.assertEqual('PASSWORD' in resources[0].get('ConnectionProperties'), False)
+
 
 class TestGlueDevEndpoints(BaseTest):