# ConnectionPasswordEncryption

Connection-password encryption configuration for a Glue Data Catalog.

When enabled, the Data Catalog encrypts the password as part of
`CreateConnection` or `UpdateConnection` and stores it in the
`ENCRYPTED_PASSWORD` field of the connection properties. This is independent
from catalog encryption at rest, and may use a different KMS key.

- Source: [`aws-glue/lib/catalog.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-glue/lib/catalog.ts#L110)
- Type last changed: v2.270.0 · 17 Sep 2026

## Example

```ts
declare const key: kms.Key;
glue.Catalog.encryptAccount(this, {
  connectionPasswordEncryption: {
    kmsKey: key,
    // Whether GetConnection/GetConnections return the password encrypted (default: true)
    returnConnectionPasswordEncrypted: true,
  },
});
```

## Properties

- `kmsKey`: [IKeyRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_kms.IKeyRef.html) — The KMS key used to encrypt connection passwords.

  **Default:** an AWS-managed key is used and the key is not exposed as a grantable resource.

- `returnConnectionPasswordEncrypted`: boolean = true — Whether passwords remain encrypted in the responses of `GetConnection` and `GetConnections`.

  This takes effect independently from catalog encryption.