🛡️ AWS Glue Python Shell Job uses a runtime past end of support🟢

• Contextual name: 🛡️ Python Shell Job uses a runtime past end of support🟢
• ID: /ce/ca/aws/glue/job-python-shell-runtime-support
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: BEST_PRACTICE
• Policy Categories: RELIABILITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 AWS Glue Job
  • 🔌 AWS Glue Job - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

This policy identifies AWS Glue Python shell job definitions configured with an unambiguously identified runtime that has passed AWS end of support (EOS). Migrate these workloads to a supported Python shell runtime or retire definitions that are no longer needed.

Rationale

AWS does not provide security patches or technical support for runtimes past EOS and may not honor their SLAs. At EOL, AWS prevents new jobs and job runs and stops existing runs. Reviewing retained job definitions helps prevent failures when scheduled or infrequently used workloads are needed again.

Impact

Runtime migration can change Python behavior and dependency compatibility. Test the script, libraries, permissions, input data, and output correctness before changing production jobs. A finding describes the collected configuration; it does not prove that the job recently executed on the retired runtime.

Audit

This policy marks an AWS Glue Job as INCOMPLIANT if Command: Name is pythonshell and Command: Python Version is 2 or 3.6. AWS has already ended support for these runtimes. Glue Version does not determine Python shell runtime support: AWS documents that this setting is ignored for Python shell jobs. Comparisons use the engine's normal case and whitespace normalization.

... see more

Remediation

Open File

Remediation

Migrate the Python shell job to a supported runtime

1. Confirm the job owner, triggers, schedules, data sources, downstream dependencies, Python runtime, and whether the definition is still needed. Retire an obsolete job through the organization's normal change process.

2. Review the current AWS Glue support policy and Python shell migration guidance. Select a supported runtime compatible with the workload; Python shell 3.9 is the reviewed migration target.

   Changing GlueVersion alone does not migrate a Python shell runtime.

3. Preserve the complete job configuration, script, dependencies, and trigger configuration. Create a separate test job with the target Python version, compatible dependencies, IAM permissions, connections, security configuration, and capacity.

   Avoid overlapping production writes while testing. Coordinate scheduled and external invocations,

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 Cloudaware Framework → 💼 Infrastructure Modernization			39		no data