@aws-cdk/aws-glue-alpha.TableClientSideEncryption

TableClientSideEncryption Class

Client-side encryption for an S3Table's data.

Independent of the bucket's server-side encryption and of who owns the bucket: the data is encrypted by the client before it is written to S3. When set, the grant* methods also grant the relevant KMS permissions on the key.

Source

lib/s3-table.ts

Type last changed

v2.270.0-alpha.0 · 18 Sep 2026

Example

declare const myDatabase: glue.Database;
// KMS key is created automatically
new glue.S3Table(this, 'MyTable', {
  clientSideEncryption: glue.TableClientSideEncryption.kms(),
  // ...
  database: myDatabase,
  columns: [{
    name: 'col1',
    type: glue.Schema.STRING,
  }],
  dataFormat: glue.DataFormat.JSON,
});

// with an explicit KMS key
new glue.S3Table(this, 'MyTable', {
  clientSideEncryption: glue.TableClientSideEncryption.kms(new kms.Key(this, 'MyKey')),
  // ...
  database: myDatabase,
  columns: [{
    name: 'col1',
    type: glue.Schema.STRING,
  }],
  dataFormat: glue.DataFormat.JSON,
});

Methods

kms(key?: IKeyRef): TableClientSideEncryption // chainable@staticmethod def kms(key: typing.Optional[IKeyRef] = None) -> TableClientSideEncryptionpublic static TableClientSideEncryption kms(IKeyRef key)public static TableClientSideEncryption Kms(IKeyRef? key = null)func Kms(Key IKeyRef) TableClientSideEncryptionstatic#

Client-side encryption (CSE-KMS) with an AWS KMS key managed by the account owner.

1 parameter

Parameters

• keykeykeykeyKey — the KMS key used to encrypt the data.