# CatalogEncryptionMode

The encryption-at-rest mode for a Glue Data Catalog.

- Source: [`aws-glue/lib/catalog.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-glue/lib/catalog.ts#L18)
- Type last changed: v2.270.0 · 17 Sep 2026

## Members

| Member | Description |
| --- | --- |
| `DISABLED` | Encryption at rest is disabled. |
| `SSE_KMS` | Server-side encryption (SSE) with an AWS KMS key. |
| `SSE_KMS_WITH_SERVICE_ROLE` | Server-side encryption (SSE) with an AWS KMS key, using a service role that AWS Glue assumes to access the key on your behalf. |

## Referenced by

- [`DataCatalogEncryptionAtRest`](/v2/docs/aws-cdk-lib.aws_glue.DataCatalogEncryptionAtRest).mode