Glue with Encrypted Job Bookmarks
A bookmark records exactly where a job reached in your data - which partitions, which keys - and it is written in plain text unless a security configuration says otherwise. That configuration is attached at job CREATION, so adding one later means rebuilding every job.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-12 · how we verify
Use it from the registry
terraform · opentofumodule "glue" {
source = "www.iac-bazaar.com/iac-bazaar/aws-glue/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-glue
A Glue catalog database, the crawlers that fill it, the jobs that read it, and
the security configuration without which none of it is encrypted. Works with
Terraform and OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0.
Job bookmarks are the part nobody encrypts. A bookmark records exactly where a job got to in your data - which partitions, which keys, which offsets - and it is written in plain text unless a security configuration says otherwise. It is not the data; it is a precise map of the data. Job logs are the same story, and they routinely contain sample rows because that is what people print when a transform is wrong.
A security configuration is attached at job creation. Adding one to an
existing job means replacing the job, so a catalogue of jobs built without one
stays without one until somebody rebuilds them. That is why this module creates
one by default rather than offering it, and why bookmarks_are_encrypted is an
output.
The catalog's own metadata is a separate, account-wide setting. Table names,
column names and S3 paths live in the Data Catalog, which has one encryption
setting per account per region - not per database. encrypt_data_catalog is
therefore opt-in, and turning it on changes every catalog in the account,
including ones other teams own. Its other half matters on its own: without it, a
Glue connection's database password is returned in plain text to anything that
can call GetConnection.
Defaults that differ from AWS's, each for a reason:
timeout_minutes60, not 2880. The AWS default is two days of a running job nobody is watching, billed per worker--job-bookmark-optionenabled. Without it the job re-processes everything it has already read on every run, and the only symptom is the bill--enable-continuous-cloudwatch-logon. Off, a job that fails halfway leaves nothing to read but a stack tracerecrawl_behavior = CRAWL_NEW_FOLDERS_ONLY. The default re-reads the whole prefix every rundelete_behavior = DEPRECATE_IN_DATABASE. A crawler that cannot see a path today - a permission slip, an empty prefix - would otherwise delete the table, and the query that depended on it fails with "table not found" rather than returning no rowsdatabase_nameis validated lower-case, because Glue lower-cases it silently and then your SQL does not match
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-dms
ssl_mode defaults to none in AWS, so a task reads your entire production database and writes it elsewhere unencrypted. This defaults to require, refuses none unless stated, and pushes the credential into Secrets Manager rather than state.
aws-athena
Query results are a copy of the data, written to S3. Without enforce_workgroup_configuration - the AWS default - a client sends its own location and encryption and every setting becomes a suggestion.
aws-aurora
Aurora PostgreSQL/MySQL cluster with instances, parameter groups, Serverless v2 scaling, and enhanced monitoring.
aws-documentdb
A cluster whose two dangerous AWS defaults are inverted: storage encryption is hard-coded on because it cannot be added later, and the master password is never an input - Secrets Manager generates it, so it never reaches the state file.
aws-dynamodb-table
DynamoDB table with GSIs/LSIs, TTL, streams, autoscaling or on-demand, and point-in-time recovery.
aws-elasticache-redis
A cluster-mode-disabled ElastiCache Redis/Valkey cache with encryption at rest and in transit both on, no public exposure, and the subnet group and security group created for you.