During a security review, a company identified a vulnerability in an AWS Glue job. The company discovered that credentials to access an Amazon Redshift cluster were hard coded in the job script. A dat

AWS Glue job parameters are not designed for secure storage of sensitive credentials and may expose them in logs or console outputs.

Storing credentials in a configuration file in an S3 bucket, even if encrypted, lacks the specialized security features like automated rotation and fine-grained access control offered by AWS Secrets Manager.

Accessing credentials from an S3 configuration file, even using the AWS SDK, is less secure and less manageable than using AWS Secrets Manager for sensitive data like database credentials.

AWS Secrets Manager is designed for securely storing, managing, and retrieving sensitive credentials like database passwords, providing features such as encryption, auditing, and automatic rotation, making it the industry best practice.

For the AWS Glue job to access the securely stored credentials in Secrets Manager, its associated IAM role must be granted the necessary permissions (e.g., secretsmanager:GetSecretValue) to retrieve those secrets.