{"id":21187,"library":"dynamodb-encryption-sdk","title":"AWS DynamoDB Encryption Client for Python","description":"Client-side encryption library for Amazon DynamoDB that encrypts attribute values before storing them. Current version 3.3.0 (Aug 2024), Python 3.8+ required. Released by AWS, follows semantic versioning.","status":"active","version":"3.3.0","language":"python","source_language":"en","source_url":"https://github.com/aws/aws-dynamodb-encryption-python","tags":["dynamodb","encryption","aws","client-side-encryption","kms"],"install":[{"cmd":"pip install dynamodb-encryption-sdk","lang":"bash","label":"PyPI"}],"dependencies":[],"imports":[{"note":"Moved to top-level package in v3.x","wrong":"from dynamodb_encryption_sdk.crypto import CryptoConfig","symbol":"CryptoConfig","correct":"from dynamodb_encryption_sdk import CryptoConfig"},{"note":"Common typo: 'materials' vs 'material'","wrong":"from dynamodb_encryption_sdk.materials_providers.block import BlockCryptoMaterialsManager","symbol":"BlockCryptoMaterialsManager","correct":"from dynamodb_encryption_sdk.material_providers.block import BlockCryptoMaterialsManager"},{"note":"","wrong":"","symbol":"AwsKmsCryptographicMaterialsProvider","correct":"from dynamodb_encryption_sdk.material_providers.aws_kms import AwsKmsCryptographicMaterialsProvider"}],"quickstart":{"code":"import boto3\nfrom dynamodb_encryption_sdk import CryptoConfig, CryptoActions\nfrom dynamodb_encryption_sdk.material_providers.aws_kms import AwsKmsCryptographicMaterialsProvider\nfrom dynamodb_encryption_sdk.structures import TableInfo\n\nkms_cmk_id = 'arn:aws:kms:us-east-1:123456789012:key/abc123'\nkey_provider = AwsKmsCryptographicMaterialsProvider(key_id=kms_cmk_id)\ntable_info = TableInfo(name='my_table')\nconfig = CryptoConfig(materials_provider=key_provider, crypto_actions=CryptoActions.DO_NOTHING)\n\nclient = boto3.client('dynamodb')\n# Encrypt an item before put_item\nplaintext_item = {'pk': {'S': 'test'}, 'data': {'S': 'secret'}}\nencrypted_item = config.encrypt_item(plaintext_item)\nclient.put_item(TableName='my_table', Item=encrypted_item)\n\n# Decrypt on get\nresponse = client.get_item(TableName='my_table', Key={'pk': {'S': 'test'}})\ndecrypted_item = config.decrypt_item(response['Item'])\nprint(decrypted_item['data']['S'])","lang":"python","description":"Demonstrates encrypting and decrypting an item using AWS KMS CMP."},"warnings":[{"fix":"Upgrade Python to 3.8+ and use dynamodb-encryption-sdk>=3.0.0.","message":"Version 3.x drops Python 2, 3.4, 3.5, 3.6, and 3.7. Only Python 3.8+ supported. Use Python 3.8 or later.","severity":"breaking","affected_versions":"3.0.0+"},{"fix":"Use CachingMostRecentProvider from dynamodb_encryption_sdk.material_providers.caching.","message":"MostRecentProvider removed in v2.0.0. Replaced by CachingMostRecentProvider in v1.3.0, then removed entirely.","severity":"breaking","affected_versions":"2.0.0+"},{"fix":"Upgrade Python to 3.8+.","message":"Python 3.7 support deprecated in v3.3.0 and may be removed in future.","severity":"deprecated","affected_versions":"3.3.0+"},{"fix":"Pass a fresh botocore session or use the default session. Avoid sharing the same session across multiple material providers.","message":"AwsKmsCryptographicMaterialsProvider uses boto3 sessions; reusing a custom session can cause client conflicts if the same session is modified elsewhere.","severity":"gotcha","affected_versions":"all"},{"fix":"Create a new TableInfo and CryptoConfig per table, or use the table's schema from DynamoDB.","message":"Do not reuse encryption config across different table structures. TableInfo includes table schema metadata that must match the actual table.","severity":"gotcha","affected_versions":"all"}],"env_vars":null,"last_verified":"2026-04-27T00:00:00.000Z","next_check":"2026-07-26T00:00:00.000Z","problems":[{"fix":"Install with: pip install dynamodb-encryption-sdk. Then import: import dynamodb_encryption_sdk","cause":"Package not installed or mistyped name.","error":"ModuleNotFoundError: No module named 'dynamodb_encryption_sdk'"},{"fix":"Use: from dynamodb_encryption_sdk import CryptoConfig","cause":"Using old import path from v2.x or earlier.","error":"AttributeError: module 'dynamodb_encryption_sdk' has no attribute 'CryptoConfig'"},{"fix":"The correct parameter is 'key_id'. Ensure you are using dynamodb-encryption-sdk>=3.0.0 and pass 'key_id' as the KMS key identifier.","cause":"Using AwsKmsCryptographicMaterialsProvider with 'key_id' parameter, but it expects 'key_id' correctly. Maybe 'key_arn' from old API.","error":"TypeError: __init__() got an unexpected keyword argument 'key_id'"},{"fix":"Check KMS key policy and IAM permissions. Ensure the role has kms:Encrypt and kms:Decrypt for the specified key.","cause":"The KMS key does not have the correct key policy to allow encrypt/decrypt from the current IAM role/user.","error":"dynamodb_encryption_sdk.exceptions.AWSKmsError: An error occurred (AccessDeniedException) when calling the Decrypt operation: ..."}],"ecosystem":"pypi","meta_description":null,"install_score":null,"install_tag":null,"quickstart_score":null,"quickstart_tag":null}