@aws-cdk/aws-s3tables-alpha 2.194.0-alpha.0 → 2.196.0-alpha.0

package/.warnings.jsii.js

@@ -14,11 +14,15 @@ function _aws_cdk_aws_s3tables_alpha_UnreferencedFileRemoval(p) {
 }
 function _aws_cdk_aws_s3tables_alpha_UnreferencedFileRemovalStatus(p) {
 }
+function _aws_cdk_aws_s3tables_alpha_TableBucketEncryption(p) {
+}
 function _aws_cdk_aws_s3tables_alpha_TableBucketProps(p) {
     if (p == null)
         return;
     visitedObjects.add(p);
     try {
+        if (!visitedObjects.has(p.encryption))
+            _aws_cdk_aws_s3tables_alpha_TableBucketEncryption(p.encryption);
         if (!visitedObjects.has(p.unreferencedFileRemoval))
             _aws_cdk_aws_s3tables_alpha_UnreferencedFileRemoval(p.unreferencedFileRemoval);
     }
@@ -80,4 +84,4 @@ class DeprecationError extends Error {
         });
     }
 }
-module.exports = { print, getPropertyDescriptor, DeprecationError, _aws_cdk_aws_s3tables_alpha_ITableBucket, _aws_cdk_aws_s3tables_alpha_UnreferencedFileRemoval, _aws_cdk_aws_s3tables_alpha_UnreferencedFileRemovalStatus, _aws_cdk_aws_s3tables_alpha_TableBucketProps, _aws_cdk_aws_s3tables_alpha_TableBucketAttributes, _aws_cdk_aws_s3tables_alpha_TableBucket, _aws_cdk_aws_s3tables_alpha_TableBucketPolicyProps, _aws_cdk_aws_s3tables_alpha_TableBucketPolicy };
+module.exports = { print, getPropertyDescriptor, DeprecationError, _aws_cdk_aws_s3tables_alpha_ITableBucket, _aws_cdk_aws_s3tables_alpha_UnreferencedFileRemoval, _aws_cdk_aws_s3tables_alpha_UnreferencedFileRemovalStatus, _aws_cdk_aws_s3tables_alpha_TableBucketEncryption, _aws_cdk_aws_s3tables_alpha_TableBucketProps, _aws_cdk_aws_s3tables_alpha_TableBucketAttributes, _aws_cdk_aws_s3tables_alpha_TableBucket, _aws_cdk_aws_s3tables_alpha_TableBucketPolicyProps, _aws_cdk_aws_s3tables_alpha_TableBucketPolicy };

package/README.md

@@ -47,9 +47,11 @@ Learn more about table buckets maintenance operations and default behavior from
 // Grant the principal read permissions to the bucket and all tables within
 const accountId = '123456789012'
 tableBucket.grantRead(new iam.AccountPrincipal(accountId), '*');
+
 // Grant the role write permissions to the bucket and all tables within
 const role = new iam.Role(stack, 'MyRole', { assumedBy: new iam.ServicePrincipal('sample') });
 tableBucket.grantWrite(role, '*');
+
 // Grant the user read and write permissions to the bucket and all tables within 
 tableBucket.grantReadWrite(new iam.User(stack, 'MyUser'), '*');
 
@@ -68,6 +70,42 @@ const permissions = new iam.PolicyStatement({
 tableBucket.addToResourcePolicy(permissions);
 ```
 
+### Controlling Table Bucket Encryption Settings
+
+S3 TableBuckets have SSE (server-side encryption with AES-256) enabled by default with S3 managed keys.
+You can also bring your own KMS key for KMS-SSE or have S3 create a KMS key for you.
+
+If a bucket is encrypted with KMS, grant functions on the bucket will also grant access
+to the TableBucket's associated KMS key.
+
+```ts
+// Provide a user defined KMS Key:
+const key = new kms.Key(scope, 'UserKey', {});
+const encryptedBucket = new TableBucket(scope, 'EncryptedTableBucket', {
+    tableBucketName: 'table-bucket-1',
+    encryption: TableBucketEncryption.KMS,
+    encryptionKey: key,
+});
+// This account principal will also receive kms:Decrypt access to the KMS key
+encryptedBucket.grantRead(new iam.AccountPrincipal('123456789012'), '*');
+
+// Use S3 managed server side encryption (default)
+const encryptedBucketDefault = new TableBucket(scope, 'EncryptedTableBucketDefault', {
+    tableBucketName: 'table-bucket-3',
+    encryption: TableBucketEncryption.S3_MANAGED, // Uses AES-256 encryption by default
+});
+```
+
+When using KMS encryption (`TableBucketEncryption.KMS`), if no encryption key is provided, CDK will automatically create a new KMS key for the table bucket with necessary permissions.
+
+```ts
+// If no key is provided, one will be created automatically
+const encryptedBucketAuto = new TableBucket(scope, 'EncryptedTableBucketAuto', {
+    tableBucketName: 'table-bucket-2',
+    encryption: TableBucketEncryption.KMS,
+});
+```
+
 ## Coming Soon
 
 L2 Construct support for:

package/lib/permissions.d.ts

@@ -1,3 +1,6 @@
 export declare const TABLE_BUCKET_READ_ACCESS: string[];
 export declare const TABLE_BUCKET_WRITE_ACCESS: string[];
 export declare const TABLE_BUCKET_READ_WRITE_ACCESS: string[];
+export declare const KEY_READ_ACCESS: string[];
+export declare const KEY_WRITE_ACCESS: string[];
+export declare const KEY_READ_WRITE_ACCESS: string[];

package/lib/permissions.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TABLE_BUCKET_READ_WRITE_ACCESS = exports.TABLE_BUCKET_WRITE_ACCESS = exports.TABLE_BUCKET_READ_ACCESS = void 0;
+exports.KEY_READ_WRITE_ACCESS = exports.KEY_WRITE_ACCESS = exports.KEY_READ_ACCESS = exports.TABLE_BUCKET_READ_WRITE_ACCESS = exports.TABLE_BUCKET_WRITE_ACCESS = exports.TABLE_BUCKET_READ_ACCESS = void 0;
 // Read priveleges
 exports.TABLE_BUCKET_READ_ACCESS = [
     's3tables:Get*',
@@ -21,4 +21,17 @@ exports.TABLE_BUCKET_READ_WRITE_ACCESS = [...new Set([
         ...exports.TABLE_BUCKET_READ_ACCESS,
         ...exports.TABLE_BUCKET_WRITE_ACCESS,
     ])];
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVybWlzc2lvbnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJwZXJtaXNzaW9ucy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxrQkFBa0I7QUFDTCxRQUFBLHdCQUF3QixHQUFHO0lBQ3RDLGVBQWU7SUFDZix3QkFBd0I7SUFDeEIscUJBQXFCO0NBQ3RCLENBQUM7QUFFRixtQkFBbUI7QUFDTixRQUFBLHlCQUF5QixHQUFHO0lBQ3ZDLHVCQUF1QjtJQUN2QixzQ0FBc0M7SUFDdEMsMEJBQTBCO0lBQzFCLDBCQUEwQjtJQUMxQixpREFBaUQ7SUFDakQsc0JBQXNCO0lBQ3RCLHNCQUFzQjtDQUN2QixDQUFDO0FBRVcsUUFBQSw4QkFBOEIsR0FBRyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUM7UUFDeEQsR0FBRyxnQ0FBd0I7UUFDM0IsR0FBRyxpQ0FBeUI7S0FDN0IsQ0FBQyxDQUFDLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBSZWFkIHByaXZlbGVnZXNcbmV4cG9ydCBjb25zdCBUQUJMRV9CVUNLRVRfUkVBRF9BQ0NFU1MgPSBbXG4gICdzM3RhYmxlczpHZXQqJyxcbiAgJ3MzdGFibGVzOkxpc3ROYW1lc3BhY2UnLFxuICAnczN0YWJsZXM6TGlzdFRhYmxlcycsXG5dO1xuXG4vLyBXcml0ZSBwcml2ZWxlZ2VzXG5leHBvcnQgY29uc3QgVEFCTEVfQlVDS0VUX1dSSVRFX0FDQ0VTUyA9IFtcbiAgJ3MzdGFibGVzOlB1dFRhYmxlRGF0YScsXG4gICdzM3RhYmxlczpVcGRhdGVUYWJsZU1ldGFkYXRhTG9jYXRpb24nLFxuICAnczN0YWJsZXM6Q3JlYXRlTmFtZXNwYWNlJyxcbiAgJ3MzdGFibGVzOkRlbGV0ZU5hbWVzcGFjZScsXG4gICdzM3RhYmxlczpQdXRUYWJsZUJ1Y2tldE1haW50ZW5hbmNlQ29uZmlndXJhdGlvbicsXG4gICdzM3RhYmxlczpDcmVhdGVUYWJsZScsXG4gICdzM3RhYmxlczpSZW5hbWVUYWJsZScsXG5dO1xuXG5leHBvcnQgY29uc3QgVEFCTEVfQlVDS0VUX1JFQURfV1JJVEVfQUNDRVNTID0gWy4uLm5ldyBTZXQoW1xuICAuLi5UQUJMRV9CVUNLRVRfUkVBRF9BQ0NFU1MsXG4gIC4uLlRBQkxFX0JVQ0tFVF9XUklURV9BQ0NFU1MsXG5dKV07XG4iXX0=
+// Permissions for user defined KMS Keys
+// https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-kms-permissions.html
+exports.KEY_READ_ACCESS = [
+    'kms:Decrypt',
+];
+exports.KEY_WRITE_ACCESS = [
+    'kms:Decrypt',
+    'kms:GenerateDataKey*',
+];
+exports.KEY_READ_WRITE_ACCESS = [...new Set([
+        ...exports.KEY_READ_ACCESS,
+        ...exports.KEY_WRITE_ACCESS,
+    ])];
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVybWlzc2lvbnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJwZXJtaXNzaW9ucy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxrQkFBa0I7QUFDTCxRQUFBLHdCQUF3QixHQUFHO0lBQ3RDLGVBQWU7SUFDZix3QkFBd0I7SUFDeEIscUJBQXFCO0NBQ3RCLENBQUM7QUFFRixtQkFBbUI7QUFDTixRQUFBLHlCQUF5QixHQUFHO0lBQ3ZDLHVCQUF1QjtJQUN2QixzQ0FBc0M7SUFDdEMsMEJBQTBCO0lBQzFCLDBCQUEwQjtJQUMxQixpREFBaUQ7SUFDakQsc0JBQXNCO0lBQ3RCLHNCQUFzQjtDQUN2QixDQUFDO0FBRVcsUUFBQSw4QkFBOEIsR0FBRyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUM7UUFDeEQsR0FBRyxnQ0FBd0I7UUFDM0IsR0FBRyxpQ0FBeUI7S0FDN0IsQ0FBQyxDQUFDLENBQUM7QUFFSix3Q0FBd0M7QUFDeEMsdUZBQXVGO0FBQzFFLFFBQUEsZUFBZSxHQUFHO0lBQzdCLGFBQWE7Q0FDZCxDQUFDO0FBRVcsUUFBQSxnQkFBZ0IsR0FBRztJQUM5QixhQUFhO0lBQ2Isc0JBQXNCO0NBQ3ZCLENBQUM7QUFFVyxRQUFBLHFCQUFxQixHQUFHLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQztRQUMvQyxHQUFHLHVCQUFlO1FBQ2xCLEdBQUcsd0JBQWdCO0tBQ3BCLENBQUMsQ0FBQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gUmVhZCBwcml2ZWxlZ2VzXG5leHBvcnQgY29uc3QgVEFCTEVfQlVDS0VUX1JFQURfQUNDRVNTID0gW1xuICAnczN0YWJsZXM6R2V0KicsXG4gICdzM3RhYmxlczpMaXN0TmFtZXNwYWNlJyxcbiAgJ3MzdGFibGVzOkxpc3RUYWJsZXMnLFxuXTtcblxuLy8gV3JpdGUgcHJpdmVsZWdlc1xuZXhwb3J0IGNvbnN0IFRBQkxFX0JVQ0tFVF9XUklURV9BQ0NFU1MgPSBbXG4gICdzM3RhYmxlczpQdXRUYWJsZURhdGEnLFxuICAnczN0YWJsZXM6VXBkYXRlVGFibGVNZXRhZGF0YUxvY2F0aW9uJyxcbiAgJ3MzdGFibGVzOkNyZWF0ZU5hbWVzcGFjZScsXG4gICdzM3RhYmxlczpEZWxldGVOYW1lc3BhY2UnLFxuICAnczN0YWJsZXM6UHV0VGFibGVCdWNrZXRNYWludGVuYW5jZUNvbmZpZ3VyYXRpb24nLFxuICAnczN0YWJsZXM6Q3JlYXRlVGFibGUnLFxuICAnczN0YWJsZXM6UmVuYW1lVGFibGUnLFxuXTtcblxuZXhwb3J0IGNvbnN0IFRBQkxFX0JVQ0tFVF9SRUFEX1dSSVRFX0FDQ0VTUyA9IFsuLi5uZXcgU2V0KFtcbiAgLi4uVEFCTEVfQlVDS0VUX1JFQURfQUNDRVNTLFxuICAuLi5UQUJMRV9CVUNLRVRfV1JJVEVfQUNDRVNTLFxuXSldO1xuXG4vLyBQZXJtaXNzaW9ucyBmb3IgdXNlciBkZWZpbmVkIEtNUyBLZXlzXG4vLyBodHRwczovL2RvY3MuYXdzLmFtYXpvbi5jb20vQW1hem9uUzMvbGF0ZXN0L3VzZXJndWlkZS9zMy10YWJsZXMta21zLXBlcm1pc3Npb25zLmh0bWxcbmV4cG9ydCBjb25zdCBLRVlfUkVBRF9BQ0NFU1MgPSBbXG4gICdrbXM6RGVjcnlwdCcsXG5dO1xuXG5leHBvcnQgY29uc3QgS0VZX1dSSVRFX0FDQ0VTUyA9IFtcbiAgJ2ttczpEZWNyeXB0JyxcbiAgJ2ttczpHZW5lcmF0ZURhdGFLZXkqJyxcbl07XG5cbmV4cG9ydCBjb25zdCBLRVlfUkVBRF9XUklURV9BQ0NFU1MgPSBbLi4ubmV3IFNldChbXG4gIC4uLktFWV9SRUFEX0FDQ0VTUyxcbiAgLi4uS0VZX1dSSVRFX0FDQ0VTUyxcbl0pXTtcbiJdfQ==

package/lib/table-bucket-policy.d.ts

@@ -29,6 +29,8 @@ export interface TableBucketPolicyProps {
  * Instead, TableBucket.addToResourcePolicy can be used to add more policies to your bucket directly
  */
 export declare class TableBucketPolicy extends Resource {
+    /** Uniquely identifies this class. */
+    static readonly PROPERTY_INJECTION_ID: string;
     /**
      * The IAM PolicyDocument containing permissions represented by this policy.
      */

package/lib/table-bucket-policy.js

@@ -1,4 +1,10 @@
 "use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
 var _a;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TableBucketPolicy = void 0;
@@ -8,13 +14,14 @@ const aws_s3tables_1 = require("aws-cdk-lib/aws-s3tables");
 const iam = require("aws-cdk-lib/aws-iam");
 const core_1 = require("aws-cdk-lib/core");
 const metadata_resource_1 = require("aws-cdk-lib/core/lib/metadata-resource");
+const prop_injectable_1 = require("aws-cdk-lib/core/lib/prop-injectable");
 /**
  * A Bucket Policy for S3 TableBuckets.
  *
  * You will almost never need to use this construct directly.
  * Instead, TableBucket.addToResourcePolicy can be used to add more policies to your bucket directly
  */
-class TableBucketPolicy extends core_1.Resource {
+let TableBucketPolicy = class TableBucketPolicy extends core_1.Resource {
     constructor(scope, id, props) {
         super(scope, id);
         try {
@@ -38,8 +45,13 @@ class TableBucketPolicy extends core_1.Resource {
             this._resource.applyRemovalPolicy(props.removalPolicy);
         }
     }
-}
+};
 exports.TableBucketPolicy = TableBucketPolicy;
 _a = JSII_RTTI_SYMBOL_1;
-TableBucketPolicy[_a] = { fqn: "@aws-cdk/aws-s3tables-alpha.TableBucketPolicy", version: "2.194.0-alpha.0" };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGFibGUtYnVja2V0LXBvbGljeS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbInRhYmxlLWJ1Y2tldC1wb2xpY3kudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7O0FBQ0EsMkRBQWdFO0FBQ2hFLDJDQUEyQztBQUMzQywyQ0FBMkQ7QUFFM0QsOEVBQThFO0FBdUI5RTs7Ozs7R0FLRztBQUNILE1BQWEsaUJBQWtCLFNBQVEsZUFBUTtJQVU3QyxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQTZCO1FBQ3JFLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7Ozs7OzsrQ0FYUixpQkFBaUI7Ozs7UUFZMUIsbUNBQW1DO1FBQ25DLElBQUEsd0NBQW9CLEVBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBRWxDLGdEQUFnRDtRQUNoRCxJQUFJLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQyxjQUFjLElBQUksSUFBSSxHQUFHLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBRW5FLElBQUksQ0FBQyxTQUFTLEdBQUcsSUFBSSxtQ0FBb0IsQ0FBQyxJQUFJLEVBQUUsRUFBRSxFQUFFO1lBQ2xELGNBQWMsRUFBRSxLQUFLLENBQUMsV0FBVyxDQUFDLGNBQWM7WUFDaEQsY0FBYyxFQUFFLElBQUksQ0FBQyxRQUFRO1NBQzlCLENBQUMsQ0FBQztRQUVILElBQUksS0FBSyxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQ3hCLElBQUksQ0FBQyxTQUFTLENBQUMsa0JBQWtCLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ3pELENBQUM7S0FDRjs7QUExQkgsOENBMkJDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQgeyBDZm5UYWJsZUJ1Y2tldFBvbGljeSB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1zM3RhYmxlcyc7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWlhbSc7XG5pbXBvcnQgeyBSZW1vdmFsUG9saWN5LCBSZXNvdXJjZSB9IGZyb20gJ2F3cy1jZGstbGliL2NvcmUnO1xuaW1wb3J0IHsgSVRhYmxlQnVja2V0IH0gZnJvbSAnLi90YWJsZS1idWNrZXQnO1xuaW1wb3J0IHsgYWRkQ29uc3RydWN0TWV0YWRhdGEgfSBmcm9tICdhd3MtY2RrLWxpYi9jb3JlL2xpYi9tZXRhZGF0YS1yZXNvdXJjZSc7XG5cbi8qKlxuICogUGFyYW1ldGVycyBmb3IgY29uc3RydWN0aW5nIGEgVGFibGVCdWNrZXRQb2xpY3lcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBUYWJsZUJ1Y2tldFBvbGljeVByb3BzIHtcbiAgLyoqXG4gICAqIFRoZSBhc3NvY2lhdGVkIHRhYmxlIGJ1Y2tldFxuICAgKi9cbiAgcmVhZG9ubHkgdGFibGVCdWNrZXQ6IElUYWJsZUJ1Y2tldDtcbiAgLyoqXG4gICAqIFRoZSBwb2xpY3kgZG9jdW1lbnQgZm9yIHRoZSBidWNrZXQncyByZXNvdXJjZSBwb2xpY3lcbiAgICogQGRlZmF1bHQgdW5kZWZpbmVkIEFuIGVtcHR5IGlhbS5Qb2xpY3lEb2N1bWVudCB3aWxsIGJlIGluaXRpYWxpemVkXG4gICAqL1xuICByZWFkb25seSByZXNvdXJjZVBvbGljeT86IGlhbS5Qb2xpY3lEb2N1bWVudDtcbiAgLyoqXG4gICAqIFBvbGljeSB0byBhcHBseSB3aGVuIHRoZSBwb2xpY3kgaXMgcmVtb3ZlZCBmcm9tIHRoaXMgc3RhY2suXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gUmVtb3ZhbFBvbGljeS5ERVNUUk9ZLlxuICAgKi9cbiAgcmVhZG9ubHkgcmVtb3ZhbFBvbGljeT86IFJlbW92YWxQb2xpY3k7XG59XG5cbi8qKlxuICogQSBCdWNrZXQgUG9saWN5IGZvciBTMyBUYWJsZUJ1Y2tldHMuXG4gKlxuICogWW91IHdpbGwgYWxtb3N0IG5ldmVyIG5lZWQgdG8gdXNlIHRoaXMgY29uc3RydWN0IGRpcmVjdGx5LlxuICogSW5zdGVhZCwgVGFibGVCdWNrZXQuYWRkVG9SZXNvdXJjZVBvbGljeSBjYW4gYmUgdXNlZCB0byBhZGQgbW9yZSBwb2xpY2llcyB0byB5b3VyIGJ1Y2tldCBkaXJlY3RseVxuICovXG5leHBvcnQgY2xhc3MgVGFibGVCdWNrZXRQb2xpY3kgZXh0ZW5kcyBSZXNvdXJjZSB7XG4gIC8qKlxuICAgKiBUaGUgSUFNIFBvbGljeURvY3VtZW50IGNvbnRhaW5pbmcgcGVybWlzc2lvbnMgcmVwcmVzZW50ZWQgYnkgdGhpcyBwb2xpY3kuXG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgZG9jdW1lbnQ6IGlhbS5Qb2xpY3lEb2N1bWVudDtcbiAgLyoqXG4gICAqIEBpbnRlcm5hbCBUaGUgdW5kZXJseWluZyBwb2xpY3kgcmVzb3VyY2UuXG4gICAqL1xuICBwcml2YXRlIHJlYWRvbmx5IF9yZXNvdXJjZTogQ2ZuVGFibGVCdWNrZXRQb2xpY3k7XG5cbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM6IFRhYmxlQnVja2V0UG9saWN5UHJvcHMpIHtcbiAgICBzdXBlcihzY29wZSwgaWQpO1xuICAgIC8vIEVuaGFuY2VkIENESyBBbmFseXRpY3MgVGVsZW1ldHJ5XG4gICAgYWRkQ29uc3RydWN0TWV0YWRhdGEodGhpcywgcHJvcHMpO1xuXG4gICAgLy8gVXNlIGRlZmF1bHQgcG9saWN5IGlmIG5vdCBwcm92aWRlZCB3aXRoIHByb3BzXG4gICAgdGhpcy5kb2N1bWVudCA9IHByb3BzLnJlc291cmNlUG9saWN5IHx8IG5ldyBpYW0uUG9saWN5RG9jdW1lbnQoe30pO1xuXG4gICAgdGhpcy5fcmVzb3VyY2UgPSBuZXcgQ2ZuVGFibGVCdWNrZXRQb2xpY3kodGhpcywgaWQsIHtcbiAgICAgIHRhYmxlQnVja2V0QXJuOiBwcm9wcy50YWJsZUJ1Y2tldC50YWJsZUJ1Y2tldEFybixcbiAgICAgIHJlc291cmNlUG9saWN5OiB0aGlzLmRvY3VtZW50LFxuICAgIH0pO1xuXG4gICAgaWYgKHByb3BzLnJlbW92YWxQb2xpY3kpIHtcbiAgICAgIHRoaXMuX3Jlc291cmNlLmFwcGx5UmVtb3ZhbFBvbGljeShwcm9wcy5yZW1vdmFsUG9saWN5KTtcbiAgICB9XG4gIH1cbn1cbiJdfQ==
+TableBucketPolicy[_a] = { fqn: "@aws-cdk/aws-s3tables-alpha.TableBucketPolicy", version: "2.196.0-alpha.0" };
+/** Uniquely identifies this class. */
+TableBucketPolicy.PROPERTY_INJECTION_ID = '@aws-cdk.aws-s3tables-alpha.TableBucketPolicy';
+exports.TableBucketPolicy = TableBucketPolicy = __decorate([
+    prop_injectable_1.propertyInjectable
+], TableBucketPolicy);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGFibGUtYnVja2V0LXBvbGljeS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbInRhYmxlLWJ1Y2tldC1wb2xpY3kudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7O0FBQ0EsMkRBQWdFO0FBQ2hFLDJDQUEyQztBQUMzQywyQ0FBMkQ7QUFFM0QsOEVBQThFO0FBQzlFLDBFQUEwRTtBQXVCMUU7Ozs7O0dBS0c7QUFFSSxJQUFNLGlCQUFpQixHQUF2QixNQUFNLGlCQUFrQixTQUFRLGVBQVE7SUFZN0MsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUE2QjtRQUNyRSxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDOzs7Ozs7K0NBYlIsaUJBQWlCOzs7O1FBYzFCLG1DQUFtQztRQUNuQyxJQUFBLHdDQUFvQixFQUFDLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQztRQUVsQyxnREFBZ0Q7UUFDaEQsSUFBSSxDQUFDLFFBQVEsR0FBRyxLQUFLLENBQUMsY0FBYyxJQUFJLElBQUksR0FBRyxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUVuRSxJQUFJLENBQUMsU0FBUyxHQUFHLElBQUksbUNBQW9CLENBQUMsSUFBSSxFQUFFLEVBQUUsRUFBRTtZQUNsRCxjQUFjLEVBQUUsS0FBSyxDQUFDLFdBQVcsQ0FBQyxjQUFjO1lBQ2hELGNBQWMsRUFBRSxJQUFJLENBQUMsUUFBUTtTQUM5QixDQUFDLENBQUM7UUFFSCxJQUFJLEtBQUssQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUN4QixJQUFJLENBQUMsU0FBUyxDQUFDLGtCQUFrQixDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUN6RCxDQUFDO0tBQ0Y7O0FBNUJVLDhDQUFpQjs7O0FBQzVCLHNDQUFzQztBQUNmLHVDQUFxQixHQUFXLCtDQUErQyxBQUExRCxDQUEyRDs0QkFGNUYsaUJBQWlCO0lBRDdCLG9DQUFrQjtHQUNOLGlCQUFpQixDQTZCN0IiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7IENmblRhYmxlQnVja2V0UG9saWN5IH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLXMzdGFibGVzJztcbmltcG9ydCAqIGFzIGlhbSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IFJlbW92YWxQb2xpY3ksIFJlc291cmNlIH0gZnJvbSAnYXdzLWNkay1saWIvY29yZSc7XG5pbXBvcnQgeyBJVGFibGVCdWNrZXQgfSBmcm9tICcuL3RhYmxlLWJ1Y2tldCc7XG5pbXBvcnQgeyBhZGRDb25zdHJ1Y3RNZXRhZGF0YSB9IGZyb20gJ2F3cy1jZGstbGliL2NvcmUvbGliL21ldGFkYXRhLXJlc291cmNlJztcbmltcG9ydCB7IHByb3BlcnR5SW5qZWN0YWJsZSB9IGZyb20gJ2F3cy1jZGstbGliL2NvcmUvbGliL3Byb3AtaW5qZWN0YWJsZSc7XG5cbi8qKlxuICogUGFyYW1ldGVycyBmb3IgY29uc3RydWN0aW5nIGEgVGFibGVCdWNrZXRQb2xpY3lcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBUYWJsZUJ1Y2tldFBvbGljeVByb3BzIHtcbiAgLyoqXG4gICAqIFRoZSBhc3NvY2lhdGVkIHRhYmxlIGJ1Y2tldFxuICAgKi9cbiAgcmVhZG9ubHkgdGFibGVCdWNrZXQ6IElUYWJsZUJ1Y2tldDtcbiAgLyoqXG4gICAqIFRoZSBwb2xpY3kgZG9jdW1lbnQgZm9yIHRoZSBidWNrZXQncyByZXNvdXJjZSBwb2xpY3lcbiAgICogQGRlZmF1bHQgdW5kZWZpbmVkIEFuIGVtcHR5IGlhbS5Qb2xpY3lEb2N1bWVudCB3aWxsIGJlIGluaXRpYWxpemVkXG4gICAqL1xuICByZWFkb25seSByZXNvdXJjZVBvbGljeT86IGlhbS5Qb2xpY3lEb2N1bWVudDtcbiAgLyoqXG4gICAqIFBvbGljeSB0byBhcHBseSB3aGVuIHRoZSBwb2xpY3kgaXMgcmVtb3ZlZCBmcm9tIHRoaXMgc3RhY2suXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gUmVtb3ZhbFBvbGljeS5ERVNUUk9ZLlxuICAgKi9cbiAgcmVhZG9ubHkgcmVtb3ZhbFBvbGljeT86IFJlbW92YWxQb2xpY3k7XG59XG5cbi8qKlxuICogQSBCdWNrZXQgUG9saWN5IGZvciBTMyBUYWJsZUJ1Y2tldHMuXG4gKlxuICogWW91IHdpbGwgYWxtb3N0IG5ldmVyIG5lZWQgdG8gdXNlIHRoaXMgY29uc3RydWN0IGRpcmVjdGx5LlxuICogSW5zdGVhZCwgVGFibGVCdWNrZXQuYWRkVG9SZXNvdXJjZVBvbGljeSBjYW4gYmUgdXNlZCB0byBhZGQgbW9yZSBwb2xpY2llcyB0byB5b3VyIGJ1Y2tldCBkaXJlY3RseVxuICovXG5AcHJvcGVydHlJbmplY3RhYmxlXG5leHBvcnQgY2xhc3MgVGFibGVCdWNrZXRQb2xpY3kgZXh0ZW5kcyBSZXNvdXJjZSB7XG4gIC8qKiBVbmlxdWVseSBpZGVudGlmaWVzIHRoaXMgY2xhc3MuICovXG4gIHB1YmxpYyBzdGF0aWMgcmVhZG9ubHkgUFJPUEVSVFlfSU5KRUNUSU9OX0lEOiBzdHJpbmcgPSAnQGF3cy1jZGsuYXdzLXMzdGFibGVzLWFscGhhLlRhYmxlQnVja2V0UG9saWN5JztcbiAgLyoqXG4gICAqIFRoZSBJQU0gUG9saWN5RG9jdW1lbnQgY29udGFpbmluZyBwZXJtaXNzaW9ucyByZXByZXNlbnRlZCBieSB0aGlzIHBvbGljeS5cbiAgICovXG4gIHB1YmxpYyByZWFkb25seSBkb2N1bWVudDogaWFtLlBvbGljeURvY3VtZW50O1xuICAvKipcbiAgICogQGludGVybmFsIFRoZSB1bmRlcmx5aW5nIHBvbGljeSByZXNvdXJjZS5cbiAgICovXG4gIHByaXZhdGUgcmVhZG9ubHkgX3Jlc291cmNlOiBDZm5UYWJsZUJ1Y2tldFBvbGljeTtcblxuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogVGFibGVCdWNrZXRQb2xpY3lQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG4gICAgLy8gRW5oYW5jZWQgQ0RLIEFuYWx5dGljcyBUZWxlbWV0cnlcbiAgICBhZGRDb25zdHJ1Y3RNZXRhZGF0YSh0aGlzLCBwcm9wcyk7XG5cbiAgICAvLyBVc2UgZGVmYXVsdCBwb2xpY3kgaWYgbm90IHByb3ZpZGVkIHdpdGggcHJvcHNcbiAgICB0aGlzLmRvY3VtZW50ID0gcHJvcHMucmVzb3VyY2VQb2xpY3kgfHwgbmV3IGlhbS5Qb2xpY3lEb2N1bWVudCh7fSk7XG5cbiAgICB0aGlzLl9yZXNvdXJjZSA9IG5ldyBDZm5UYWJsZUJ1Y2tldFBvbGljeSh0aGlzLCBpZCwge1xuICAgICAgdGFibGVCdWNrZXRBcm46IHByb3BzLnRhYmxlQnVja2V0LnRhYmxlQnVja2V0QXJuLFxuICAgICAgcmVzb3VyY2VQb2xpY3k6IHRoaXMuZG9jdW1lbnQsXG4gICAgfSk7XG5cbiAgICBpZiAocHJvcHMucmVtb3ZhbFBvbGljeSkge1xuICAgICAgdGhpcy5fcmVzb3VyY2UuYXBwbHlSZW1vdmFsUG9saWN5KHByb3BzLnJlbW92YWxQb2xpY3kpO1xuICAgIH1cbiAgfVxufVxuIl19

package/lib/table-bucket.d.ts

@@ -1,6 +1,7 @@
 import { Construct } from 'constructs';
 import { TableBucketPolicy } from './table-bucket-policy';
 import * as iam from 'aws-cdk-lib/aws-iam';
+import * as kms from 'aws-cdk-lib/aws-kms';
 import { Resource, IResource, RemovalPolicy } from 'aws-cdk-lib/core';
 /**
  * Interface definition for S3 Table Buckets
@@ -26,11 +27,14 @@ export interface ITableBucket extends IResource {
      * @attribute
      */
     readonly region?: string;
+    /**
+     * Optional KMS encryption key associated with this table bucket.
+     */
+    readonly encryptionKey?: kms.IKey;
     /**
      * Adds a statement to the resource policy for a principal (i.e.
      * account/role/service) to perform actions on this table bucket and/or its
-     * contents. Use `tableBucketArn` and `arnForObjects(keys)` to obtain ARNs for
-     * this bucket or objects.
+     * tables.
      *
      * Note that the policy statement may or may not be added to the policy.
      * For example, when an `ITableBucket` is created from an existing table bucket,
@@ -51,6 +55,9 @@ export interface ITableBucket extends IResource {
      * Grant read permissions for this table bucket and its tables
      * to an IAM principal (Role/Group/User).
      *
+     * If encryption is used, permission to use the key to decrypt the contents
+     * of the bucket will also be granted to the same principal.
+     *
      * @param identity The principal to allow read permissions to
      * @param tableId Allow the permissions to all tables using '*' or to single table by its unique ID.
      */
@@ -59,6 +66,9 @@ export interface ITableBucket extends IResource {
      * Grant write permissions for this table bucket and its tables
      * to an IAM principal (Role/Group/User).
      *
+     * If encryption is used, permission to use the key to encrypt the contents
+     * of the bucket will also be granted to the same principal.
+     *
      * @param identity The principal to allow write permissions to
      * @param tableId Allow the permissions to all tables using '*' or to single table by its unique ID.
      */
@@ -67,6 +77,9 @@ export interface ITableBucket extends IResource {
      * Grant read and write permissions for this table bucket and its tables
      * to an IAM principal (Role/Group/User).
      *
+     * If encryption is used, permission to use the key to encrypt/decrypt the contents
+     * of the bucket will also be granted to the same principal.
+     *
      * @param identity The principal to allow read and write permissions to
      * @param tableId Allow the permissions to all tables using '*' or to single table by its unique ID.
      */
@@ -111,6 +124,20 @@ export declare enum UnreferencedFileRemovalStatus {
      */
     DISABLED = "Disabled"
 }
+/**
+ * Controls Server Side Encryption (SSE) for this TableBucket.
+ */
+export declare enum TableBucketEncryption {
+    /**
+     * Use a customer defined KMS key for encryption
+     * If `encryptionKey` is specified, this key will be used, otherwise, one will be defined.
+     */
+    KMS = "aws:kms",
+    /**
+     * Use S3 managed encryption keys with AES256 encryption
+     */
+    S3_MANAGED = "AES256"
+}
 declare abstract class TableBucketBase extends Resource implements ITableBucket {
     abstract readonly tableBucketArn: string;
     abstract readonly tableBucketName: string;
@@ -126,6 +153,7 @@ declare abstract class TableBucketBase extends Resource implements ITableBucket
      * the first call to `addToResourcePolicy`.
      */
     protected abstract autoCreatePolicy: boolean;
+    abstract encryptionKey?: kms.IKey | undefined;
     /**
      * Adds a statement to the resource policy for a principal (i.e.
      * account/role/service) to perform actions on this table bucket and/or its
@@ -185,6 +213,25 @@ export interface TableBucketProps {
      * @default - it's assumed the bucket belongs to the same account as the scope it's being imported into
      */
     readonly account?: string;
+    /**
+     * The kind of server-side encryption to apply to this bucket.
+     *
+     * If you choose KMS, you can specify a KMS key via `encryptionKey`. If
+     * encryption key is not specified, a key will automatically be created.
+     *
+     * @default - `KMS` if `encryptionKey` is specified, or `S3_MANAGED` otherwise.
+     */
+    readonly encryption?: TableBucketEncryption;
+    /**
+     * External KMS key to use for bucket encryption.
+     *
+     * The `encryption` property must be either not specified or set to `KMS`.
+     * An error will be emitted if `encryption` is set to `S3_MANAGED`.
+     *
+     * @default - If `encryption` is set to `KMS` and this property is undefined,
+     * a new KMS key will be created and associated with this bucket.
+     */
+    readonly encryptionKey?: kms.IKey;
     /**
      * Controls what happens to this table bucket it it stoped being managed by cloudformation.
      *
@@ -193,7 +240,8 @@ export interface TableBucketProps {
     readonly removalPolicy?: RemovalPolicy;
 }
 /**
- * Everything needed to reference a specific table bucket.
+ * A reference to a table bucket outside this stack
+ *
  * The tableBucketName, region, and account can be provided explicitly
  * or will be inferred from the tableBucketArn
  */
@@ -218,6 +266,11 @@ export interface TableBucketAttributes {
      * @default tableBucketArn constructed from region, account and tableBucketName are provided
      */
     readonly tableBucketArn?: string;
+    /**
+     * Optional KMS encryption key associated with this bucket.
+     * @default - undefined
+     */
+    readonly encryptionKey?: kms.IKey;
 }
 /**
  * An S3 table bucket with helpers for associated resource policies
@@ -237,6 +290,8 @@ export interface TableBucketAttributes {
  * });
  */
 export declare class TableBucket extends TableBucketBase {
+    /** Uniquely identifies this class. */
+    static readonly PROPERTY_INJECTION_ID: string;
     /**
      * Defines a TableBucket construct from an external table bucket ARN.
      *
@@ -281,7 +336,29 @@ export declare class TableBucket extends TableBucketBase {
      * The name of this table bucket
      */
     readonly tableBucketName: string;
+    readonly encryptionKey?: kms.IKey | undefined;
     protected autoCreatePolicy: boolean;
     constructor(scope: Construct, id: string, props: TableBucketProps);
+    /**
+     * Set up key properties and return the Bucket encryption property from the
+     * user's configuration, according to the following table:
+     *
+     * | props.encryption | props.encryptionKey | bucketEncryption (return value) | encryptionKey (return value)  |
+     * |------------------|---------------------|---------------------------------|-------------------------------|
+     * | undefined        | undefined           | undefined                       | undefined                     |
+     * | undefined        | k                   | aws:kms                         | k                             |
+     * | KMS              | undefined           | aws:kms                         | new key (allow maintenance SP)|
+     * | KMS              | k                   | aws:kms                         | k                             |
+     * | S3_MANAGED       | undefined           | AES256                          | undefined                     |
+     * | S3_MANAGED       | k                   | ERROR!                          | ERROR!                        |
+     */
+    private parseEncryption;
+    /**
+     * Allowlist S3 Tables Maintenance to access this table bucket's encryption key
+     *
+     * @see https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-kms-permissions.html
+     * @param encryptionKey The key to provide access to
+     */
+    private allowTablesMaintenanceAccessToKey;
 }
 export {};