I am trying to understand how encryption on Glue job bookmarks works. I know there is a setting in security configuration to enable KMS encryption for job bookmarks but where exactly are they stored? Since Glue is a serverless ETL service, are job bookmarks stored on EC2 or file systems which are not visible to end user?
note it is stored on the service account and not the user account