[New Check]: Detect secrets in AWS Glue Data Catalog connections

[danibarranqueroo]

Existing check search

• I have searched existing issues, Prowler Hub, and the public roadmap, and this check does not already exist.

Provider

AWS

New provider name

No response

Service or product area

glue

Suggested check name

glue_catalog_connection_no_secrets

Context and goal

AWS Glue Data Catalog connections often store hardcoded database credentials in plaintext connection details.

Expected behavior

• Resource or scope to evaluate: Each Data Catalog connection.
• PASS when: No secrets are detected.
• FAIL when: A secret is detected (report the connection name, not the value).

References

• Umbrella issue: Implement more secrets checks #3085
• Secret scanning checks (developer guide): https://docs.prowler.com/developer-guide/secret-scanning-checks
• API/SDK reference: glue get_connections (Data Catalog connections, ConnectionProperties)
• Reference code: glue_etl_jobs_no_secrets_in_arguments

Suggested severity

High

Additional implementation notes

Closely related to glue_connection_no_secrets; can share the same connections model in the glue service. Consider whether to implement as one check or keep catalog-scoped. Severity is High by default and becomes Critical if the secret is validated.