Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs(dynamodb): add note around table encryption #18721

Merged
merged 2 commits into from
Jan 31, 2022
Merged

docs(dynamodb): add note around table encryption #18721

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c97230a
docs(dynamodb): add note around table encryption
rix0rrr Jan 28, 2022
fc15a49
Merge branch 'master' into huijbers/ddb-enc-note
mergify[bot] Jan 31, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions packages/@aws-cdk/aws-dynamodb/lib/table.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,12 @@ export enum TableEncryption {
/**
* Server-side KMS encryption with a customer master key managed by customer.
* If `encryptionKey` is specified, this key will be used, otherwise, one will be defined.
*
* > **NOTE**: if `encryptionKey` is not specified and the `Table` construct creates
* > a KMS key for you, the key will be created with default permissions. If you are using
* > CDKv2, these permissions will be sufficient to enable the key for use with DynamoDB tables.
* > If you are using CDKv1, make sure the feature flag `@aws-cdk/aws-kms:defaultKeyPolicies`
* > is set to `true` in your `cdk.json`.
*/
CUSTOMER_MANAGED = 'CUSTOMER_MANAGED',

Expand Down Expand Up @@ -198,6 +204,13 @@ export interface TableOptions extends SchemaOptions {
*
* This property cannot be set if `serverSideEncryption` is set.
*
* > **NOTE**: if you set this to `CUSTOMER_MANAGED` and `encryptionKey` is not
* > specified, the key that the Tablet generates for you will be created with
* > default permissions. If you are using CDKv2, these permissions will be
* > sufficient to enable the key for use with DynamoDB tables. If you are
* > using CDKv1, make sure the feature flag
* > `@aws-cdk/aws-kms:defaultKeyPolicies` is set to `true` in your `cdk.json`.
*
* @default - server-side encryption is enabled with an AWS owned customer master key
*/
readonly encryption?: TableEncryption;
Expand Down