aws-glue-job-script-source
Glue ETL scripts in S3 can hard-code credentials and configuration files.
Where it sits
| location | GetJob.Job.Command.ScriptLocation -> S3 object body |
|---|
| location kind | code_artifact |
|---|
| data kinds | source_code_secret credential password api_key private_key connection_string |
|---|
| emits edge | ContainsCredential |
|---|
| service | Glue (aws:glue) |
|---|
Collection recipe
| access mode | indirect_destination |
|---|
| operation | GetJob then s3:GetObject |
|---|
| response path | Job.Command.ScriptLocation -> GetObject.Body |
|---|
| encoding | binary |
|---|
| params | {"JobName": "\u003cjob-name\u003e"} |
|---|
Required permissions
glue:GetJob
s3:GetObject
References