{
  "typeName" : "AWS::Glue::DataCatalogEncryptionSettings",
  "description" : "Resource Type definition for AWS::Glue::DataCatalogEncryptionSettings",
  "definitions" : {
    "ConnectionPasswordEncryption" : {
      "type" : "object",
      "description" : "When connection password protection is enabled, the Data Catalog uses a customer-provided key to encrypt the password as part of CreateConnection or UpdateConnection and store it in the ENCRYPTED_PASSWORD field in the connection properties. You can enable catalog encryption or only password encryption.",
      "additionalProperties" : false,
      "properties" : {
        "KmsKeyId" : {
          "type" : "string",
          "description" : "An AWS KMS key that is used to encrypt the connection password."
        },
        "ReturnConnectionPasswordEncrypted" : {
          "type" : "boolean",
          "description" : "When the ReturnConnectionPasswordEncrypted flag is set to 'true', passwords remain encrypted in the responses of GetConnection and GetConnections. This encryption takes effect independently from catalog encryption."
        }
      }
    },
    "EncryptionAtRest" : {
      "type" : "object",
      "description" : "Specifies the encryption-at-rest configuration for the Data Catalog.",
      "additionalProperties" : false,
      "properties" : {
        "CatalogEncryptionMode" : {
          "type" : "string",
          "description" : "The encryption-at-rest mode for encrypting Data Catalog data."
        },
        "CatalogEncryptionServiceRole" : {
          "type" : "string",
          "description" : "The role that AWS Glue assumes to encrypt and decrypt the Data Catalog objects on the caller's behalf."
        },
        "SseAwsKmsKeyId" : {
          "type" : "string",
          "description" : "The ID of the AWS KMS key to use for encryption at rest."
        }
      }
    },
    "DataCatalogEncryptionSettings" : {
      "type" : "object",
      "additionalProperties" : false,
      "description" : "Contains configuration information for maintaining Data Catalog security.",
      "properties" : {
        "ConnectionPasswordEncryption" : {
          "$ref" : "#/definitions/ConnectionPasswordEncryption"
        },
        "EncryptionAtRest" : {
          "$ref" : "#/definitions/EncryptionAtRest"
        }
      }
    }
  },
  "properties" : {
    "CatalogId" : {
      "type" : "string",
      "description" : "The ID of the Data Catalog in which the settings are created."
    },
    "DataCatalogEncryptionSettings" : {
      "$ref" : "#/definitions/DataCatalogEncryptionSettings"
    }
  },
  "additionalProperties" : false,
  "tagging" : {
    "taggable" : false
  },
  "required" : [ "DataCatalogEncryptionSettings", "CatalogId" ],
  "createOnlyProperties" : [ "/properties/CatalogId" ],
  "primaryIdentifier" : [ "/properties/CatalogId" ],
  "handlers" : {
    "create" : {
      "permissions" : [ "glue:GetDataCatalogEncryptionSettings", "glue:PutDataCatalogEncryptionSettings", "iam:PassRole" ]
    },
    "read" : {
      "permissions" : [ "glue:GetDataCatalogEncryptionSettings" ]
    },
    "update" : {
      "permissions" : [ "glue:GetDataCatalogEncryptionSettings", "glue:PutDataCatalogEncryptionSettings", "iam:PassRole" ]
    },
    "delete" : {
      "permissions" : [ "glue:GetDataCatalogEncryptionSettings", "glue:PutDataCatalogEncryptionSettings" ]
    }
  }
}