Skip to content

AWS Glue Spark jobs should run on supported versions of AWS Glue

Identifier

glue-spark-job-supported-version

Category

Identify > Vulnerability, patch, and version management

Description

This control checks whether AWS Glue Spark jobs are configured to use supported and up-to-date Spark versions. Using supported versions ensures compatibility, stability, and security for your ETL workflows. This is verified by inspecting the glue_version attribute in the Terraform configuration for the aws_glue_job resource and confirming it matches one of the supported Glue Spark versions.

Non Compliant Example

Terraform
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
resource "aws_glue_job" "foo" {
  name     = "foo"
  glue_version = "1.0"
  role_arn = aws_iam_role.example.arn

  command {
    script_location = "s3://glue-bucket/example.py"
  }
  ...
}

Remediation

To fix this violation, update the glue_version attribute to a supported version such as "3.0", "4.0", or "5.0" depending on your requirements:

Terraform
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
resource "aws_glue_job" "foo" {
  name     = "foo"
  glue_version = "4.0"
  role_arn = aws_iam_role.example.arn

  command {
    script_location = "s3://glue-bucket/example.py"
  }
  ...
}

Extra Resources