# CatalogEncryptionOptions

Encryption configuration for a Glue Data Catalog.

Encryption is fixed at construction: a catalog either carries encryption
settings or it does not, which keeps its configuration easy to reason about
and avoids order-dependent mutation after the catalog is created.

- Source: [`lib/catalog.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0-alpha.0/packages/@aws-cdk/aws-glue-alpha/lib/catalog.ts#L134)
- Type last changed: v2.270.0-alpha.0 · 18 Sep 2026

## Example

```ts
import * as iam from 'aws-cdk-lib/aws-iam';
declare const key: kms.Key;
declare const role: iam.IRole;
glue.Catalog.encryptAccount(this, {
  encryptionAtRest: glue.DataCatalogEncryptionAtRest.kmsWithServiceRole(role, key),
});
```

## Properties

- `connectionPasswordEncryption`: [ConnectionPasswordEncryption](/cdk/api/v2/docs/@aws-cdk_aws-glue-alpha.ConnectionPasswordEncryption.html) — Connection-password encryption configuration for the catalog.

  **Default:** connection-password encryption is not managed by CDK

- `encryptionAtRest`: [DataCatalogEncryptionAtRest](/cdk/api/v2/docs/@aws-cdk_aws-glue-alpha.DataCatalogEncryptionAtRest.html) — Encryption-at-rest configuration for the catalog.

  **Default:** encryption at rest is not managed by CDK (the catalog default applies)