{"id":21187,"library":"dynamodb-encryption-sdk","title":"AWS DynamoDB Encryption Client for Python","description":"Client-side encryption library for Amazon DynamoDB that encrypts attribute values before storing them. Current version 3.3.0 (Aug 2024), Python 3.8+ required. Released by AWS, follows semantic versioning.","status":"active","version":"3.3.0","language":"python","source_language":"en","source_url":"https://github.com/aws/aws-dynamodb-encryption-python","tags":["dynamodb","encryption","aws","client-side-encryption","kms"],"install":[{"cmd":"pip install dynamodb-encryption-sdk","lang":"bash","label":"PyPI"}],"dependencies":[],"imports":[{"wrong":"from dynamodb_encryption_sdk import CryptoConfig","symbol":"EncryptedTable","correct":"from dynamodb_encryption_sdk import EncryptedTable"},{"symbol":"EncryptedClient","correct":"from dynamodb_encryption_sdk import EncryptedClient"},{"symbol":"EncryptedResource","correct":"from dynamodb_encryption_sdk import EncryptedResource"}],"quickstart":{"code":"import boto3\nfrom dynamodb_encryption_sdk import CryptoConfig, CryptoActions\nfrom dynamodb_encryption_sdk.material_providers.aws_kms import AwsKmsCryptographicMaterialsProvider\nfrom dynamodb_encryption_sdk.structures import TableInfo\n\nkms_cmk_id = 'arn:aws:kms:us-east-1:123456789012:key/abc123'\nkey_provider = AwsKmsCryptographicMaterialsProvider(key_id=kms_cmk_id)\ntable_info = TableInfo(name='my_table')\nconfig = CryptoConfig(materials_provider=key_provider, crypto_actions=CryptoActions.DO_NOTHING)\n\nclient = boto3.client('dynamodb')\n# Encrypt an item before put_item\nplaintext_item = {'pk': {'S': 'test'}, 'data': {'S': 'secret'}}\nencrypted_item = config.encrypt_item(plaintext_item)\nclient.put_item(TableName='my_table', Item=encrypted_item)\n\n# Decrypt on get\nresponse = client.get_item(TableName='my_table', Key={'pk': {'S': 'test'}})\ndecrypted_item = config.decrypt_item(response['Item'])\nprint(decrypted_item['data']['S'])","lang":"python","description":"Demonstrates encrypting and decrypting an item using AWS KMS CMP."},"warnings":[{"fix":"Upgrade Python to 3.8+ and use dynamodb-encryption-sdk>=3.0.0.","message":"Version 3.x drops Python 2, 3.4, 3.5, 3.6, and 3.7. Only Python 3.8+ supported. Use Python 3.8 or later.","severity":"breaking","affected_versions":"3.0.0+"},{"fix":"Use CachingMostRecentProvider from dynamodb_encryption_sdk.material_providers.caching.","message":"MostRecentProvider removed in v2.0.0. Replaced by CachingMostRecentProvider in v1.3.0, then removed entirely.","severity":"breaking","affected_versions":"2.0.0+"},{"fix":"Upgrade Python to 3.8+.","message":"Python 3.7 support deprecated in v3.3.0 and may be removed in future.","severity":"deprecated","affected_versions":"3.3.0+"},{"fix":"Pass a fresh botocore session or use the default session. Avoid sharing the same session across multiple material providers.","message":"AwsKmsCryptographicMaterialsProvider uses boto3 sessions; reusing a custom session can cause client conflicts if the same session is modified elsewhere.","severity":"gotcha","affected_versions":"all"},{"fix":"Create a new TableInfo and CryptoConfig per table, or use the table's schema from DynamoDB.","message":"Do not reuse encryption config across different table structures. TableInfo includes table schema metadata that must match the actual table.","severity":"gotcha","affected_versions":"all"}],"env_vars":null,"search_vec":"'2024':26 '3.3.0':24 '3.8':28 'amazon':13 'attribut':17 'aug':25 'aw':1,32,38 'client':4,8,40 'client-sid':7 'client-side-encrypt':39 'current':22 'dynamodb':2,14,36 'encrypt':3,10,16,37,42 'follow':33 'kms':43 'librari':11 'python':6,27 'releas':30 'requir':29 'semant':34 'side':9,41 'store':20 'valu':18 'version':23,35","created_at":"2026-04-27T16:58:32.628428+00:00","updated_at":"2026-04-27T16:58:32.628428+00:00","problems":null,"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"3.3.0","cli_name":"","cli_version":null,"type":"library","homepage":"https://docs.aws.amazon.com/dynamodb-encryption-sdk/","github":"https://github.com/aws/aws-dynamodb-encryption-python","docs":null,"changelog":null,"pypi":"https://pypi.org/project/dynamodb-encryption-sdk/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["aws","auth-security","database"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-06-30","last_verified":"2026-06-30","next_check":"2026-07-30","install_tag":null}}