# TableClientSideEncryption

Client-side encryption for an `S3Table`'s data.

Independent of the bucket's server-side encryption and of who owns the bucket:
the data is encrypted by the client before it is written to S3. When set, the
`grant*` methods also grant the relevant KMS permissions on the key.

- Source: [`aws-glue/lib/s3-table.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-glue/lib/s3-table.ts#L115)
- Type last changed: v2.270.0 · 17 Sep 2026

## Example

```ts
declare const myDatabase: glue.Database;
// KMS key is created automatically
new glue.S3Table(this, 'MyTable', {
  clientSideEncryption: glue.TableClientSideEncryption.kms(),
  // ...
  database: myDatabase,
  columns: [{
    name: 'col1',
    type: glue.Schema.STRING,
  }],
  dataFormat: glue.DataFormat.JSON,
});

// with an explicit KMS key
new glue.S3Table(this, 'MyTable', {
  clientSideEncryption: glue.TableClientSideEncryption.kms(new kms.Key(this, 'MyKey')),
  // ...
  database: myDatabase,
  columns: [{
    name: 'col1',
    type: glue.Schema.STRING,
  }],
  dataFormat: glue.DataFormat.JSON,
});
```

## Methods

- `kms(key?: IKeyRef): TableClientSideEncryption // chainable` (static) — Client-side encryption (CSE-KMS) with an AWS KMS key managed by the account owner.

  **Parameters**

  - `key` — the KMS key used to encrypt the data.