# S3Encryption

S3 encryption configuration for a `SecurityConfiguration`.

Use {@link S3Encryption.s3Managed} for SSE-S3 or {@link S3Encryption.kms} for
SSE-KMS. Because these are separate factories, a KMS key can never be paired
with S3-managed encryption.

- Source: [`lib/security-configuration.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0-alpha.0/packages/@aws-cdk/aws-glue-alpha/lib/security-configuration.ts#L52)
- Type last changed: v2.270.0-alpha.0 · 18 Sep 2026

## Example

```ts
new glue.SecurityConfiguration(this, 'MySecurityConfiguration', {
  cloudWatchEncryption: glue.CloudWatchEncryption.kms(),
  jobBookmarksEncryption: glue.JobBookmarksEncryption.clientSideKms(),
  s3Encryption: glue.S3Encryption.kms(),
});
```

## Methods

- `kms(kmsKey?: IKeyRef): S3Encryption // chainable` (static) — Server-side encryption (SSE) with an AWS KMS key managed by the account owner.

  **Parameters**

  - `kmsKey` — the KMS key used to encrypt the data.

- `s3Managed(): S3Encryption // chainable` (static) — Server-side encryption (SSE) with an Amazon S3-managed key.