# ConnectionPasswordEncryption

Connection-password encryption configuration for a Glue Data Catalog.

When enabled, the Data Catalog encrypts the password as part of
`CreateConnection` or `UpdateConnection` and stores it in the
`ENCRYPTED_PASSWORD` field of the connection properties. This is independent
from catalog encryption at rest, and may use a different KMS key.

- Source: [`lib/catalog.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0-alpha.0/packages/@aws-cdk/aws-glue-alpha/lib/catalog.ts#L110)
- Type last changed: v2.270.0-alpha.0 · 18 Sep 2026

## Example

```ts
declare const key: kms.Key;
glue.Catalog.encryptAccount(this, {
  connectionPasswordEncryption: {
    kmsKey: key,
    // Whether GetConnection/GetConnections return the password encrypted (default: true)
    returnConnectionPasswordEncrypted: true,
  },
});
```

## Properties

- `kmsKey`: [IKeyRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_kms.IKeyRef.html) — The KMS key used to encrypt connection passwords.

  **Default:** an AWS-managed key is used and the key is not exposed as a grantable resource.

- `returnConnectionPasswordEncrypted`: boolean = true — Whether passwords remain encrypted in the responses of `GetConnection` and `GetConnections`.

  This takes effect independently from catalog encryption.