Setting the file. One moment.
Skill 50 · Connecting To Data Source
Subchapter 50.2
references/credential-security.mdMarkdown4 KBView on GitHub
Order of preference for authenticating Glue connections to data sources:
SECRET_ID)USERNAME/PASSWORD in connection properties (not recommended)Supported sources:
GetClusterCredentials / GetCredentials)Benefits:
Enable IAM DB auth on the cluster or instance:
aws rds modify-db-instance \
--db-instance-identifier <ID> \
--enable-iam-database-authentication \
--apply-immediatelyCreate a DB user that authenticates via IAM (MySQL):
CREATE USER 'etl_user'@'%' IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';
GRANT SELECT ON app_db.* TO 'etl_user'@'%';PostgreSQL:
CREATE USER etl_user;
GRANT rds_iam TO etl_user;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO etl_user;Grant the Glue job role the rds-db:connect action:
{
"Effect": "Allow",
"Action": "rds-db:connect",
"Resource": "arn:aws:rds-db:<region>:<account>:dbuser:<resource-id>/etl_user"
}In the Glue connection, omit SECRET_ID, USERNAME, and PASSWORD. Glue generates an auth token on each connection.
Grant the Glue role redshift:GetClusterCredentials (provisioned) or redshift-serverless:GetCredentials (serverless), scoped to the cluster/workgroup and DB user.
Configure the connection with the Redshift endpoint and a DB user. No password.
When IAM DB auth is not available (Oracle, SQL Server, Snowflake, BigQuery, self-managed), use Secrets Manager.
JDBC sources:
aws secretsmanager create-secret \
--name glue/<connection-name>/credentials \
--secret-string '{"username":"etl_user","password":"<password>"}' \
--region <region>Snowflake (key names are Glue-specific):
aws secretsmanager create-secret \
--name glue/snowflake-analytics/credentials \
--secret-string '{"snowflakeUser":"ETL_USER","snowflakePassword":"<password>"}' \
--region <region>BigQuery (base64 of service account JSON, stored as the secret string directly):
base64 -i <sa>.json | tr -d '\n' | \
aws secretsmanager create-secret \
--name glue/bigquery/<project-id>/credentials \
--secret-string file:///dev/stdin \
--region <region>{
"Effect": "Allow",
"Action": "secretsmanager:GetSecretValue",
"Resource": "arn:aws:secretsmanager:<region>:<account>:secret:glue/<connection-name>/credentials-*"
}The -* suffix matches the random 6-character suffix Secrets Manager appends.
"ConnectionProperties": {
"JDBC_CONNECTION_URL": "...",
"SECRET_ID": "glue/<connection-name>/credentials"
}Omit USERNAME and PASSWORD. Glue reads them from the secret at job runtime.
Not recommended. Use only for:
If you must, use USERNAME and PASSWORD in ConnectionProperties. The password is encrypted at rest in the Data Catalog but visible in get-connection responses to any principal with glue:GetConnection.
Secrets Manager rotation:
IAM DB auth: no rotation – tokens are minted per-connection and expire in 15 minutes.
Service account keys (BigQuery) / key-pairs (Snowflake): rotate by generating a new key at the source, updating the Secrets Manager value, and letting the old key expire or be deleted in the source.