fix: add security configuration for Glue crawler with KMS encryption

Author: Bob Strahan

template.yaml

@@ -1581,13 +1581,29 @@ Resources:
           - Name: date
             Type: string
 
+  DocumentSectionsCrawlerSecurityConfiguration:
+    Type: AWS::Glue::SecurityConfiguration
+    Properties:
+      Name: !Sub "${AWS::StackName}-document-sections-crawler-security-config"
+      EncryptionConfiguration:
+        S3Encryptions:
+          - S3EncryptionMode: SSE-KMS
+            KmsKeyArn: !GetAtt CustomerManagedEncryptionKey.Arn
+        CloudWatchEncryption:
+          CloudWatchEncryptionMode: SSE-KMS
+          KmsKeyArn: !GetAtt CustomerManagedEncryptionKey.Arn
+        JobBookmarksEncryption:
+          JobBookmarksEncryptionMode: CSE-KMS
+          KmsKeyArn: !GetAtt CustomerManagedEncryptionKey.Arn
+
   DocumentSectionsCrawler:
     Type: AWS::Glue::Crawler
     Properties:
       Name: !Sub "${AWS::StackName}-document-sections-crawler"
       Description: "Crawler to discover document section tables in the reporting bucket with conservative schema handling"
       Role: !GetAtt DocumentSectionsCrawlerRole.Arn
       DatabaseName: !Ref ReportingDatabase
+      CrawlerSecurityConfiguration: !Ref DocumentSectionsCrawlerSecurityConfiguration
       Targets:
         S3Targets:
           - Path: !Sub