AWS Glue Job not encrypted by Customer Managed Key (CMK)
This policy identifies AWS Glue jobs that are encrypted using the default KMS key instead of CMK (Customer Managed Key) or using the CMK that is disabled.

AWS Glue allows you to specify whether the data processed by the job should be encrypted when stored in data storage locations such as Amazon S3. To protect sensitive data from unauthorized access, users can specify CMK to get enhanced security, and control over the encryption key and also comply with any regulatory requirements.

It is recommended to use a CMK to encrypt the AWS Glue job data as it provides complete control over the encrypted data.
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: To encrypt data processed by AWS Glue jobs, configure encryption settings within the security configuration of the Glue job. Security configurations cannot be edited from the console, so we need to create a new security configuration with the necessary settings and attach it to the existing Glue job.

To add a security configuration using the AWS Glue console,

1. Sign in to the AWS Management Console: Go to the AWS Management Console at https://console.aws.amazon.com/.
2. Navigate to the reported resource region by selecting the region from the dropdown in the top right corner.
3. Navigate to AWS Glue: In the "Find Services" search box, type "Glue" and select "AWS Glue" from the search results.
4. To add a security configuration using the AWS Glue console, choose 'Security Configurations' in the navigation pane.
5. Choose 'Add security configuration'.
6. on the Security configuration properties, Enter a unique security configuration name in the name text box.
7. To Enable S3 encryption, select the checkbox under the 'Enable S3 encryption' section.
8. Select the 'SSE-KMS' option in the 'Encryption mode' and choose an AWS KMS CMK key, or choose Enter a key ARN of the CMK and provide the ARN for the key that you are managing according to your business requirements.
9. Click 'Create' to create a security configuration.


To add a security configuration to the existing glue job.

1. Sign in to the AWS Management Console: Go to the AWS Management Console at https://console.aws.amazon.com/.
2. Navigate to the reported resource region by selecting the region from the dropdown in the top right corner.
3. Navigate to AWS Glue: In the "Find Services" search box, type "Glue" and select "AWS Glue" from the search results.
4. Choose the ETL jobs in the navigation pane.
5. select the reported job under the Your Jobs section.
6. select the Job details tab.
7. select the newly created security configuration from the dropdown in the 'Security configuration' section under the 'Advance properties' dropdown.
8. Click 'Save'.

To enable the KMS CMK key, please refer to the below link.
https://docs.aws.amazon.com/kms/latest/developerguide/enabling-keys.html#enabling-keys-console.

Query:
```config from cloud.resource where api.name = 'aws-glue-job' as X; config from cloud.resource where api.name = 'aws-glue-security-configuration' as Y; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyManager does not equal CUSTOMER or (keyMetadata.keyManager equals CUSTOMER and keyMetadata.keyState equals Disabled) as Z; filter '$.X.SecurityConfiguration does not exist or ( $.X.SecurityConfiguration equals $.Y.name and ($.Y.encryptionConfiguration.s3Encryption[*].s3EncryptionMode does not equal "SSE-KMS" or ($.Y.encryptionConfiguration.s3Encryption[*].kmsKeyArn exists and $.Y.encryptionConfiguration.s3Encryption[*].kmsKeyArn equals $.Z.keyMetadata.arn)))' ; show X;```