AWS CDK Reference

Appearance

v2.274.0

S3Encryption Class ​

S3 encryption configuration for a SecurityConfiguration.

Use {@link S3Encryption.s3Managed} for SSE-S3 or {@link S3Encryption.kms} for SSE-KMS. Because these are separate factories, a KMS key can never be paired with S3-managed encryption.

Source
lib/security-configuration.ts
Type last changed
v2.270.0-alpha.0 · 18 Sep 2026

Example ​

ts
new glue.SecurityConfiguration(this, 'MySecurityConfiguration', {
  cloudWatchEncryption: glue.CloudWatchEncryption.kms(),
  jobBookmarksEncryption: glue.JobBookmarksEncryption.clientSideKms(),
  s3Encryption: glue.S3Encryption.kms(),
});

Methods ​

kms(kmsKey?: IKeyRef): S3Encryption // chainable@staticmethod def kms(kms_key: typing.Optional[IKeyRef] = None) -> S3Encryptionpublic static S3Encryption kms(IKeyRef kmsKey)public static S3Encryption Kms(IKeyRef? kmsKey = null)func Kms(KmsKey IKeyRef) S3Encryptionstatic#
Server-side encryption (SSE) with an AWS KMS key managed by the account owner.
1 parameter

Parameters

  • kmsKeykms_keykmsKeykmsKeyKmsKey — the KMS key used to encrypt the data.
s3Managed(): S3Encryption // chainable@staticmethod def s3_managed() -> S3Encryptionpublic static S3Encryption s3Managed()public static S3Encryption S3Managed()func S3Managed() S3Encryptionstatic#
Server-side encryption (SSE) with an Amazon S3-managed key.