Package: dynamodb-encryption-sdk
TheAmazon DynamoDB Encryption Client for Pythonprovides client-side encryption ofAmazon
DynamoDBitems to help you to protect your table data before you send it to DynamoDB. It
provides an implementation of theAmazon DynamoDB Encryption Clientthat is fully compatible
with theAmazon DynamoDB Encryption Client for Java.You can find the latest Python documentation atRead the Docsand you can find the latest
full documents in ourprimary documents.You can find our source onGitHub.Security issue notificationsSeeSupport Policyfor details on the current support status of all major versions of this library.Getting StartedRequired PrerequisitesPython 3.7+InstallationNoteIf you have not already installedcryptography, you might need to install additional
prerequisites as detailed in thecryptography installation guidefor your operating
system.$ pip install dynamodb-encryption-sdkConceptsFor a detailed description of the concepts that are important to understand when using this
client, please review ourConcepts Guide.UsageHelper ClientsWe provide helper clients that look and feel like the low level client (EncryptedClient),
service resource (EncryptedResource), and table resource (EncryptedTable) available
from theboto3library. For most uses, once configured, these clients can be used exactly
as you would a standard client fromboto3, and your items will be transparently encrypted
on write and decrypted on read.What can’t I do with the helper clients?For most uses, the helper clients (once configured) can be used as drop-in replacements for
theboto3clients. However, there are a couple cases where this is not the case.Update ItemBecause we can’t know that a partial update you might be making to an item covers all
of the signed attributes in your item, we do not allowupdate_itemon the helper clients.This is because if you update only some of the signed attributes, then next time you try
to read that item the signature validation will fail.Attribute FilteringBecause we can’t know what attributes in an item are signed, the helper clients do not allow
any attribute filtering.Forget_item,batch_get_item, andscan, this includes the use ofAttributesToGetandProjectionExpression.Forscan, this also includes the use ofSelectvaluesSPECIFIC_ATTRIBUTESandALL_PROJECTED_ATTRIBUTES.This is because if you do not retrieve all signed attributes, the signature validation will
fail.Item EncryptorThe helper clients provide a familiar interface but the actual item encryption and decryption
is handled by a low-level item encryptor. You usually will not need to interact with these
low-level functions, but for certain advanced use cases it can be useful.If you do choose to use the item encryptor functions directly, you will need to provide aCryptoConfigfor each call.>>>fromdynamodb_encryption_sdk.encrypted.itemimportdecrypt_python_item,encrypt_python_item>>>plaintext_item={...'some':'data',...'more':5...}>>>encrypted_item=encrypt_python_item(...item=plaintext_item,...crypto_config=my_crypto_config...)>>>decrypted_item=decrypt_python_item(...item=encrypted_item,...crypto_config=my_crypto_config...)When should I use the item encryptor?One example of a use case where you might want to use the item encryptor directly is when
processing items in aDynamoDB Stream. Since you receive the items data directly, and
in DynamoDB JSON format, you can use thedecrypt_dynamodb_itemfunction to decrypt the
item in the stream. We also provide helpertransformation functionsAdvanced UseBy default, the helper clients use your attribute actions and cryptographic materials provider
to build theCryptoConfigthat is provided to the item encryptor. For some advanced use
cases, you might want to provide a customCryptoConfigfor specific operations.All data plane operations (get item, put item, etc) on helper clients accept acrypto_configparameter in addition to all of the parameters that the underlyingboto3client accepts.If this parameter is supplied, thatCryptoConfigwill be used for that operation instead
of the one that the client would normally construct for you.>>>fromdynamodb_encryption_sdk.encrypted.tableimportEncryptedTable>>>encrypted_table=EncryptedTable(...table=table,...materials_provider=my_crypto_materials_provider...)>>>encrypted_table.put_item(...Item=my_standard_item...)# this uses the crypto config built by the helper>>>encrypted_table.put_item(...Item=my_special_item,...crypto_config=my_special_crypto_config...)# this uses my_special_crypto_config