@aws-cdk/aws-s3tables-alpha 2.212.0-alpha.0 → 2.213.0-alpha.0

package/.jsii

@@ -8,7 +8,7 @@
     "url": "https://aws.amazon.com"
   },
   "dependencies": {
-    "aws-cdk-lib": "^2.212.0",
+    "aws-cdk-lib": "^2.213.0",
     "constructs": "^10.0.0"
   },
   "dependencyClosure": {
@@ -4079,7 +4079,7 @@
   },
   "name": "@aws-cdk/aws-s3tables-alpha",
   "readme": {
-    "markdown": "# Amazon S3 Tables Construct Library\n<!--BEGIN STABILITY BANNER-->\n\n---\n\n![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)\n\n> The APIs of higher level constructs in this module are experimental and under active development.\n> They are subject to non-backward compatible changes or removal in any future version. These are\n> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be\n> announced in the release notes. This means that while you may use them, you may need to update\n> your source code when upgrading to a newer version of this package.\n\n---\n\n<!--END STABILITY BANNER-->\n\n## Amazon S3 Tables\n\nAmazon S3 Tables deliver the first cloud object store with built-in Apache Iceberg support and streamline storing tabular data at scale.\n\n[Product Page](https://aws.amazon.com/s3/features/tables/) | [User Guide](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables.html)\n\n\n## Usage\n\n### Define an S3 Table Bucket\n\n```ts\n// Build a Table bucket\nconst sampleTableBucket = new TableBucket(scope, 'ExampleTableBucket', {\n    tableBucketName: 'example-bucket-1',\n    // optional fields:\n    unreferencedFileRemoval: {\n        status: UnreferencedFileRemovalStatus.ENABLED,\n        noncurrentDays: 20,\n        unreferencedDays: 20,\n    }\n});\n```\n\n### Define an S3 Tables Namespace\n\n```ts\n// Build a namespace\nconst sampleNamespace = new Namespace(scope, 'ExampleNamespace', {\n    namespaceName: 'example-namespace-1',\n    tableBucket: tableBucket,\n});\n```\n\n### Define an S3 Table\n\n```ts\n// Build a table\nconst sampleTable = new Table(scope, 'ExampleTable', {\n    tableName: 'example_table',\n    namespace: namespace,\n    openTableFormat: OpenTableFormat.ICEBERG,\n    withoutMetadata: true,\n});\n\n// Build a table with an Iceberg Schema\nconst sampleTableWithSchema = new Table(scope, 'ExampleSchemaTable', {\n    tableName: 'example_table_with_schema',\n    namespace: namespace,\n    openTableFormat: OpenTableFormat.ICEBERG,\n    icebergMetadata: {\n        icebergSchema: {\n            schemaFieldList: [\n            {\n                name: 'id',\n                type: 'int',\n                required: true,\n            },\n            {\n                name: 'name',\n                type: 'string',\n            },\n            ],\n        },\n    },\n    compaction: {\n        status: Status.ENABLED,\n        targetFileSizeMb: 128,\n    },\n    snapshotManagement: {\n        status: Status.ENABLED,\n        maxSnapshotAgeHours: 48,\n        minSnapshotsToKeep: 5,\n    },\n});\n```\n\nLearn more about table buckets maintenance operations and default behavior from the [S3 Tables User Guide](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-table-buckets-maintenance.html)\n\n### Controlling Table Bucket Permissions\n\n```ts\n// Grant the principal read permissions to the bucket and all tables within\nconst accountId = '123456789012'\ntableBucket.grantRead(new iam.AccountPrincipal(accountId), '*');\n\n// Grant the role write permissions to the bucket and all tables within\nconst role = new iam.Role(stack, 'MyRole', { assumedBy: new iam.ServicePrincipal('sample') });\ntableBucket.grantWrite(role, '*');\n\n// Grant the user read and write permissions to the bucket and all tables within\ntableBucket.grantReadWrite(new iam.User(stack, 'MyUser'), '*');\n\n// Grant permissions to the bucket and a particular table within it\nconst tableId = '6ba046b2-26de-44cf-9144-0c7862593a7b'\ntableBucket.grantReadWrite(new iam.AccountPrincipal(accountId), tableId);\n\n// Add custom resource policy statements\nconst permissions = new iam.PolicyStatement({\n    effect: iam.Effect.ALLOW,\n    actions: ['s3tables:*'],\n    principals: [ new iam.ServicePrincipal('example.aws.internal') ],\n    resources: ['*']\n});\n\ntableBucket.addToResourcePolicy(permissions);\n```\n\n### Controlling Table Bucket Encryption Settings\n\nS3 TableBuckets have SSE (server-side encryption with AES-256) enabled by default with S3 managed keys.\nYou can also bring your own KMS key for KMS-SSE or have S3 create a KMS key for you.\n\nIf a bucket is encrypted with KMS, grant functions on the bucket will also grant access\nto the TableBucket's associated KMS key.\n\n```ts\n// Provide a user defined KMS Key:\nconst key = new kms.Key(scope, 'UserKey', {});\nconst encryptedBucket = new TableBucket(scope, 'EncryptedTableBucket', {\n    tableBucketName: 'table-bucket-1',\n    encryption: TableBucketEncryption.KMS,\n    encryptionKey: key,\n});\n// This account principal will also receive kms:Decrypt access to the KMS key\nencryptedBucket.grantRead(new iam.AccountPrincipal('123456789012'), '*');\n\n// Use S3 managed server side encryption (default)\nconst encryptedBucketDefault = new TableBucket(scope, 'EncryptedTableBucketDefault', {\n    tableBucketName: 'table-bucket-3',\n    encryption: TableBucketEncryption.S3_MANAGED, // Uses AES-256 encryption by default\n});\n```\n\nWhen using KMS encryption (`TableBucketEncryption.KMS`), if no encryption key is provided, CDK will automatically create a new KMS key for the table bucket with necessary permissions.\n\n```ts\n// If no key is provided, one will be created automatically\nconst encryptedBucketAuto = new TableBucket(scope, 'EncryptedTableBucketAuto', {\n    tableBucketName: 'table-bucket-2',\n    encryption: TableBucketEncryption.KMS,\n});\n```\n\n## Coming Soon\n\nL2 Construct support for:\n\n- Table Policy\n- KMS encryption support for Tables\n"
+    "markdown": "# Amazon S3 Tables Construct Library\n<!--BEGIN STABILITY BANNER-->\n\n---\n\n![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)\n\n> The APIs of higher level constructs in this module are experimental and under active development.\n> They are subject to non-backward compatible changes or removal in any future version. These are\n> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be\n> announced in the release notes. This means that while you may use them, you may need to update\n> your source code when upgrading to a newer version of this package.\n\n---\n\n<!--END STABILITY BANNER-->\n\n## Amazon S3 Tables\n\nAmazon S3 Tables deliver the first cloud object store with built-in Apache Iceberg support and streamline storing tabular data at scale.\n\n[Product Page](https://aws.amazon.com/s3/features/tables/) | [User Guide](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables.html)\n\n\n## Usage\n\n### Define an S3 Table Bucket\n\n```ts\n// Build a Table bucket\nconst sampleTableBucket = new TableBucket(scope, 'ExampleTableBucket', {\n    tableBucketName: 'example-bucket-1',\n    // optional fields:\n    unreferencedFileRemoval: {\n        status: UnreferencedFileRemovalStatus.ENABLED,\n        noncurrentDays: 20,\n        unreferencedDays: 20,\n    }\n});\n```\n\n### Define an S3 Tables Namespace\n\n```ts\n// Build a namespace\nconst sampleNamespace = new Namespace(scope, 'ExampleNamespace', {\n    namespaceName: 'example-namespace-1',\n    tableBucket: tableBucket,\n});\n```\n\n### Define an S3 Table\n\n```ts\n// Build a table\nconst sampleTable = new Table(scope, 'ExampleTable', {\n    tableName: 'example_table',\n    namespace: namespace,\n    openTableFormat: OpenTableFormat.ICEBERG,\n    withoutMetadata: true,\n});\n\n// Build a table with an Iceberg Schema\nconst sampleTableWithSchema = new Table(scope, 'ExampleSchemaTable', {\n    tableName: 'example_table_with_schema',\n    namespace: namespace,\n    openTableFormat: OpenTableFormat.ICEBERG,\n    icebergMetadata: {\n        icebergSchema: {\n            schemaFieldList: [\n            {\n                name: 'id',\n                type: 'int',\n                required: true,\n            },\n            {\n                name: 'name',\n                type: 'string',\n            },\n            ],\n        },\n    },\n    compaction: {\n        status: Status.ENABLED,\n        targetFileSizeMb: 128,\n    },\n    snapshotManagement: {\n        status: Status.ENABLED,\n        maxSnapshotAgeHours: 48,\n        minSnapshotsToKeep: 5,\n    },\n});\n```\n\nLearn more about table buckets maintenance operations and default behavior from the [S3 Tables User Guide](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-table-buckets-maintenance.html)\n\n### Controlling Table Bucket Permissions\n\n```ts\n// Grant the principal read permissions to the bucket and all tables within\nconst accountId = '123456789012'\ntableBucket.grantRead(new iam.AccountPrincipal(accountId), '*');\n\n// Grant the role write permissions to the bucket and all tables within\nconst role = new iam.Role(stack, 'MyRole', { assumedBy: new iam.ServicePrincipal('sample') });\ntableBucket.grantWrite(role, '*');\n\n// Grant the user read and write permissions to the bucket and all tables within\ntableBucket.grantReadWrite(new iam.User(stack, 'MyUser'), '*');\n\n// Grant permissions to the bucket and a particular table within it\nconst tableId = '6ba046b2-26de-44cf-9144-0c7862593a7b'\ntableBucket.grantReadWrite(new iam.AccountPrincipal(accountId), tableId);\n\n// Add custom resource policy statements\nconst permissions = new iam.PolicyStatement({\n    effect: iam.Effect.ALLOW,\n    actions: ['s3tables:*'],\n    principals: [ new iam.ServicePrincipal('example.aws.internal') ],\n    resources: ['*']\n});\n\ntableBucket.addToResourcePolicy(permissions);\n```\n\n### Controlling Table Bucket Encryption Settings\n\nS3 TableBuckets have SSE (server-side encryption with AES-256) enabled by default with S3 managed keys.\nYou can also bring your own KMS key for KMS-SSE or have S3 create a KMS key for you.\n\nIf a bucket is encrypted with KMS, grant functions on the bucket will also grant access\nto the TableBucket's associated KMS key.\n\n```ts\n// Provide a user defined KMS Key:\nconst key = new kms.Key(scope, 'UserKey', {});\nconst encryptedBucket = new TableBucket(scope, 'EncryptedTableBucket', {\n    tableBucketName: 'table-bucket-1',\n    encryption: TableBucketEncryption.KMS,\n    encryptionKey: key,\n});\n// This account principal will also receive kms:Decrypt access to the KMS key\nencryptedBucket.grantRead(new iam.AccountPrincipal('123456789012'), '*');\n\n// Use S3 managed server side encryption (default)\nconst encryptedBucketDefault = new TableBucket(scope, 'EncryptedTableBucketDefault', {\n    tableBucketName: 'table-bucket-3',\n    encryption: TableBucketEncryption.S3_MANAGED, // Uses AES-256 encryption by default\n});\n```\n\nWhen using KMS encryption (`TableBucketEncryption.KMS`), if no encryption key is provided, CDK will automatically create a new KMS key for the table bucket with necessary permissions.\n\n```ts\n// If no key is provided, one will be created automatically\nconst encryptedBucketAuto = new TableBucket(scope, 'EncryptedTableBucketAuto', {\n    tableBucketName: 'table-bucket-2',\n    encryption: TableBucketEncryption.KMS,\n});\n```\n\n### Controlling Table Permissions\n\n```ts\n// Grant the principal read permissions to the table\nconst accountId = '123456789012'\ntable.grantRead(new iam.AccountPrincipal(accountId));\n\n// Grant the role write permissions to the table\nconst role = new iam.Role(stack, 'MyRole', { assumedBy: new iam.ServicePrincipal('sample') });\ntable.grantWrite(role);\n\n// Grant the user read and write permissions to the table\ntable.grantReadWrite(new iam.User(stack, 'MyUser'));\n\n// Grant an account permissions to the table\ntable.grantReadWrite(new iam.AccountPrincipal(accountId));\n\n// Add custom resource policy statements\nconst permissions = new iam.PolicyStatement({\n    effect: iam.Effect.ALLOW,\n    actions: ['s3tables:*'],\n    principals: [ new iam.ServicePrincipal('example.aws.internal') ],\n    resources: ['*']\n});\n\ntable.addToResourcePolicy(permissions);\n```\n\n## Coming Soon\n\nL2 Construct support for:\n\n- KMS encryption support for Tables\n"
   },
   "repository": {
     "directory": "packages/@aws-cdk/aws-s3tables-alpha",
@@ -4129,7 +4129,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/table.ts",
-        "line": 115
+        "line": 246
       },
       "name": "CompactionProperty",
       "properties": [
@@ -4142,7 +4142,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 119
+            "line": 250
           },
           "name": "status",
           "type": {
@@ -4158,7 +4158,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 123
+            "line": 254
           },
           "name": "targetFileSizeMb",
           "type": {
@@ -4239,8 +4239,127 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/table.ts",
-        "line": 18
+        "line": 20
       },
+      "methods": [
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "Note that the policy statement may or may not be added to the policy.\nFor example, when an `ITable` is created from an existing table,\nit's not possible to tell whether the table already has a policy\nattached, let alone to re-use that policy to add more statements to it.\nSo it's safest to do nothing in these cases.",
+            "returns": "metadata about the execution of this method. If the policy\nwas not added, the value of `statementAdded` will be `false`. You\nshould always check this value to make sure that the operation was\nactually carried out. Otherwise, synthesis and deploy will terminate\nsilently, which may be confusing.",
+            "stability": "experimental",
+            "summary": "Adds a statement to the resource policy for a principal (i.e. account/role/service) to perform actions on this table."
+          },
+          "locationInModule": {
+            "filename": "lib/table.ts",
+            "line": 63
+          },
+          "name": "addToResourcePolicy",
+          "parameters": [
+            {
+              "docs": {
+                "summary": "the policy statement to be added to the table's policy."
+              },
+              "name": "statement",
+              "type": {
+                "fqn": "aws-cdk-lib.aws_iam.PolicyStatement"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "aws-cdk-lib.aws_iam.AddToResourcePolicyResult"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "If the parent TableBucket of this table has encryption,\nyou should grant kms:Decrypt permission to use this key to the same principal.",
+            "stability": "experimental",
+            "summary": "Grant read permissions for this table to an IAM principal (Role/Group/User)."
+          },
+          "locationInModule": {
+            "filename": "lib/table.ts",
+            "line": 73
+          },
+          "name": "grantRead",
+          "parameters": [
+            {
+              "docs": {
+                "summary": "The principal to allow read permissions to."
+              },
+              "name": "identity",
+              "type": {
+                "fqn": "aws-cdk-lib.aws_iam.IGrantable"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "aws-cdk-lib.aws_iam.Grant"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "If the parent TableBucket of this table has encryption,\nyou should grant kms:GenerateDataKey and kms:Decrypt permission\nto use this key to the same principal.",
+            "stability": "experimental",
+            "summary": "Grant read and write permissions for this table to an IAM principal (Role/Group/User)."
+          },
+          "locationInModule": {
+            "filename": "lib/table.ts",
+            "line": 95
+          },
+          "name": "grantReadWrite",
+          "parameters": [
+            {
+              "docs": {
+                "summary": "The principal to allow read and write permissions to."
+              },
+              "name": "identity",
+              "type": {
+                "fqn": "aws-cdk-lib.aws_iam.IGrantable"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "aws-cdk-lib.aws_iam.Grant"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "If the parent TableBucket of this table has encryption,\nyou should grant kms:GenerateDataKey and kms:Decrypt permission\nto use this key to the same principal.",
+            "stability": "experimental",
+            "summary": "Grant write permissions for this table to an IAM principal (Role/Group/User)."
+          },
+          "locationInModule": {
+            "filename": "lib/table.ts",
+            "line": 84
+          },
+          "name": "grantWrite",
+          "parameters": [
+            {
+              "docs": {
+                "summary": "The principal to allow write permissions to."
+              },
+              "name": "identity",
+              "type": {
+                "fqn": "aws-cdk-lib.aws_iam.IGrantable"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "aws-cdk-lib.aws_iam.Grant"
+            }
+          }
+        }
+      ],
       "name": "ITable",
       "properties": [
         {
@@ -4255,7 +4374,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 23
+            "line": 25
           },
           "name": "tableArn",
           "type": {
@@ -4274,7 +4393,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 29
+            "line": 31
           },
           "name": "tableName",
           "type": {
@@ -4293,7 +4412,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 35
+            "line": 37
           },
           "name": "account",
           "optional": true,
@@ -4313,7 +4432,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 41
+            "line": 43
           },
           "name": "region",
           "optional": true,
@@ -4601,7 +4720,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/table.ts",
-        "line": 144
+        "line": 275
       },
       "name": "IcebergMetadataProperty",
       "properties": [
@@ -4615,7 +4734,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 150
+            "line": 281
           },
           "name": "icebergSchema",
           "type": {
@@ -4640,7 +4759,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/table.ts",
-        "line": 156
+        "line": 287
       },
       "name": "IcebergSchemaProperty",
       "properties": [
@@ -4653,7 +4772,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 160
+            "line": 291
           },
           "name": "schemaFieldList",
           "type": {
@@ -4973,7 +5092,7 @@
       "kind": "enum",
       "locationInModule": {
         "filename": "lib/table.ts",
-        "line": 103
+        "line": 234
       },
       "members": [
         {
@@ -5002,7 +5121,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/table.ts",
-        "line": 166
+        "line": 297
       },
       "name": "SchemaFieldProperty",
       "properties": [
@@ -5015,7 +5134,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 170
+            "line": 301
           },
           "name": "name",
           "type": {
@@ -5032,7 +5151,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 186
+            "line": 317
           },
           "name": "type",
           "type": {
@@ -5050,7 +5169,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 179
+            "line": 310
           },
           "name": "required",
           "optional": true,
@@ -5078,7 +5197,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/table.ts",
-        "line": 196
+        "line": 327
       },
       "name": "SnapshotManagementProperty",
       "properties": [
@@ -5092,7 +5211,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 202
+            "line": 333
           },
           "name": "maxSnapshotAgeHours",
           "optional": true,
@@ -5110,7 +5229,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 209
+            "line": 340
           },
           "name": "minSnapshotsToKeep",
           "optional": true,
@@ -5128,7 +5247,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 216
+            "line": 347
           },
           "name": "status",
           "optional": true,
@@ -5153,7 +5272,7 @@
       "kind": "enum",
       "locationInModule": {
         "filename": "lib/table.ts",
-        "line": 129
+        "line": 260
       },
       "members": [
         {
@@ -5192,7 +5311,7 @@
         },
         "locationInModule": {
           "filename": "lib/table.ts",
-          "line": 353
+          "line": 492
         },
         "parameters": [
           {
@@ -5221,7 +5340,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/table.ts",
-        "line": 240
+        "line": 371
       },
       "methods": [
         {
@@ -5231,7 +5350,7 @@
           },
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 252
+            "line": 383
           },
           "name": "fromTableAttributes",
           "parameters": [
@@ -5280,7 +5399,7 @@
           },
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 284
+            "line": 416
           },
           "name": "validateTableName",
           "parameters": [
@@ -5295,6 +5414,110 @@
             }
           ],
           "static": true
+        },
+        {
+          "docs": {
+            "remarks": "Note that the policy statement may or may not be added to the policy.\nFor example, when an `ITable` is created from an existing table,\nit's not possible to tell whether the table already has a policy\nattached, let alone to re-use that policy to add more statements to it.\nSo it's safest to do nothing in these cases.",
+            "stability": "experimental",
+            "summary": "Adds a statement to the resource policy for a principal (i.e. account/role/service) to perform actions on this table."
+          },
+          "locationInModule": {
+            "filename": "lib/table.ts",
+            "line": 119
+          },
+          "name": "addToResourcePolicy",
+          "overrides": "@aws-cdk/aws-s3tables-alpha.ITable",
+          "parameters": [
+            {
+              "name": "statement",
+              "type": {
+                "fqn": "aws-cdk-lib.aws_iam.PolicyStatement"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "aws-cdk-lib.aws_iam.AddToResourcePolicyResult"
+            }
+          }
+        },
+        {
+          "docs": {
+            "remarks": "If the parent TableBucket of this table has encryption,\nyou should grant kms:Decrypt permission to use this key to the same principal.",
+            "stability": "experimental",
+            "summary": "Grant read permissions for this table to an IAM principal (Role/Group/User)."
+          },
+          "locationInModule": {
+            "filename": "lib/table.ts",
+            "line": 137
+          },
+          "name": "grantRead",
+          "overrides": "@aws-cdk/aws-s3tables-alpha.ITable",
+          "parameters": [
+            {
+              "name": "identity",
+              "type": {
+                "fqn": "aws-cdk-lib.aws_iam.IGrantable"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "aws-cdk-lib.aws_iam.Grant"
+            }
+          }
+        },
+        {
+          "docs": {
+            "remarks": "If the parent TableBucket of this table has encryption,\nyou should grant kms:GenerateDataKey and kms:Decrypt permission\nto use this key to the same principal.",
+            "stability": "experimental",
+            "summary": "Grant read and write permissions for this table to an IAM principal (Role/Group/User)."
+          },
+          "locationInModule": {
+            "filename": "lib/table.ts",
+            "line": 153
+          },
+          "name": "grantReadWrite",
+          "overrides": "@aws-cdk/aws-s3tables-alpha.ITable",
+          "parameters": [
+            {
+              "name": "identity",
+              "type": {
+                "fqn": "aws-cdk-lib.aws_iam.IGrantable"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "aws-cdk-lib.aws_iam.Grant"
+            }
+          }
+        },
+        {
+          "docs": {
+            "remarks": "If the parent TableBucket of this table has encryption,\nyou should grant kms:GenerateDataKey and kms:Decrypt permission\nto use this key to the same principal.",
+            "stability": "experimental",
+            "summary": "Grant write permissions for this table to an IAM principal (Role/Group/User)."
+          },
+          "locationInModule": {
+            "filename": "lib/table.ts",
+            "line": 145
+          },
+          "name": "grantWrite",
+          "overrides": "@aws-cdk/aws-s3tables-alpha.ITable",
+          "parameters": [
+            {
+              "name": "identity",
+              "type": {
+                "fqn": "aws-cdk-lib.aws_iam.IGrantable"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "aws-cdk-lib.aws_iam.Grant"
+            }
+          }
         }
       ],
       "name": "Table",
@@ -5308,7 +5531,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 243
+            "line": 374
           },
           "name": "PROPERTY_INJECTION_ID",
           "static": true,
@@ -5324,7 +5547,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 351
+            "line": 483
           },
           "name": "namespace",
           "type": {
@@ -5339,7 +5562,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 335
+            "line": 467
           },
           "name": "tableArn",
           "overrides": "@aws-cdk/aws-s3tables-alpha.ITable",
@@ -5355,13 +5578,44 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 346
+            "line": 478
           },
           "name": "tableName",
           "overrides": "@aws-cdk/aws-s3tables-alpha.ITable",
           "type": {
             "primitive": "string"
           }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "The resource policy for this table."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/table.ts",
+            "line": 488
+          },
+          "name": "tablePolicy",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_s3tables.CfnTablePolicy"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Indicates if a table resource policy should automatically created upon the first call to `addToResourcePolicy`."
+          },
+          "locationInModule": {
+            "filename": "lib/table.ts",
+            "line": 490
+          },
+          "name": "autoCreatePolicy",
+          "protected": true,
+          "type": {
+            "primitive": "boolean"
+          }
         }
       ],
       "symbolId": "lib/table:Table"
@@ -5382,7 +5636,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/table.ts",
-        "line": 225
+        "line": 356
       },
       "name": "TableAttributes",
       "properties": [
@@ -5395,7 +5649,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 234
+            "line": 365
           },
           "name": "tableArn",
           "type": {
@@ -5411,7 +5665,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 229
+            "line": 360
           },
           "name": "tableName",
           "type": {
@@ -6303,6 +6557,164 @@
       ],
       "symbolId": "lib/table-bucket:TableBucketProps"
     },
+    "@aws-cdk/aws-s3tables-alpha.TablePolicy": {
+      "assembly": "@aws-cdk/aws-s3tables-alpha",
+      "base": "aws-cdk-lib.Resource",
+      "docs": {
+        "remarks": "You will almost never need to use this construct directly.\nInstead, Table.addToResourcePolicy can be used to add more policies to your table directly",
+        "stability": "experimental",
+        "summary": "A  Policy for S3 Tables.",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as s3tables_alpha from '@aws-cdk/aws-s3tables-alpha';\nimport * as cdk from 'aws-cdk-lib';\nimport { aws_iam as iam } from 'aws-cdk-lib';\n\ndeclare const policyDocument: iam.PolicyDocument;\ndeclare const table: s3tables_alpha.Table;\nconst tablePolicy = new s3tables_alpha.TablePolicy(this, 'MyTablePolicy', {\n  table: table,\n\n  // the properties below are optional\n  removalPolicy: cdk.RemovalPolicy.DESTROY,\n  resourcePolicy: policyDocument,\n});",
+        "custom": {
+          "exampleMetadata": "fixture=_generated"
+        }
+      },
+      "fqn": "@aws-cdk/aws-s3tables-alpha.TablePolicy",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        },
+        "locationInModule": {
+          "filename": "lib/table-policy.ts",
+          "line": 49
+        },
+        "parameters": [
+          {
+            "name": "scope",
+            "type": {
+              "fqn": "constructs.Construct"
+            }
+          },
+          {
+            "name": "id",
+            "type": {
+              "primitive": "string"
+            }
+          },
+          {
+            "name": "props",
+            "type": {
+              "fqn": "@aws-cdk/aws-s3tables-alpha.TablePolicyProps"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "lib/table-policy.ts",
+        "line": 36
+      },
+      "name": "TablePolicy",
+      "properties": [
+        {
+          "const": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Uniquely identifies this class."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/table-policy.ts",
+            "line": 39
+          },
+          "name": "PROPERTY_INJECTION_ID",
+          "static": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "The IAM PolicyDocument containing permissions represented by this policy."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/table-policy.ts",
+            "line": 43
+          },
+          "name": "document",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_iam.PolicyDocument"
+          }
+        }
+      ],
+      "symbolId": "lib/table-policy:TablePolicy"
+    },
+    "@aws-cdk/aws-s3tables-alpha.TablePolicyProps": {
+      "assembly": "@aws-cdk/aws-s3tables-alpha",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Parameters for constructing a TablePolicy.",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as s3tables_alpha from '@aws-cdk/aws-s3tables-alpha';\nimport * as cdk from 'aws-cdk-lib';\nimport { aws_iam as iam } from 'aws-cdk-lib';\n\ndeclare const policyDocument: iam.PolicyDocument;\ndeclare const table: s3tables_alpha.Table;\nconst tablePolicyProps: s3tables_alpha.TablePolicyProps = {\n  table: table,\n\n  // the properties below are optional\n  removalPolicy: cdk.RemovalPolicy.DESTROY,\n  resourcePolicy: policyDocument,\n};",
+        "custom": {
+          "exampleMetadata": "fixture=_generated"
+        }
+      },
+      "fqn": "@aws-cdk/aws-s3tables-alpha.TablePolicyProps",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "lib/table-policy.ts",
+        "line": 12
+      },
+      "name": "TablePolicyProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "The associated table."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/table-policy.ts",
+            "line": 16
+          },
+          "name": "table",
+          "type": {
+            "fqn": "@aws-cdk/aws-s3tables-alpha.ITable"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- RemovalPolicy.DESTROY.",
+            "stability": "experimental",
+            "summary": "Policy to apply when the policy is removed from this stack."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/table-policy.ts",
+            "line": 27
+          },
+          "name": "removalPolicy",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.RemovalPolicy"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "undefined An empty iam.PolicyDocument will be initialized",
+            "stability": "experimental",
+            "summary": "The policy document for the table's resource policy."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/table-policy.ts",
+            "line": 21
+          },
+          "name": "resourcePolicy",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_iam.PolicyDocument"
+          }
+        }
+      ],
+      "symbolId": "lib/table-policy:TablePolicyProps"
+    },
     "@aws-cdk/aws-s3tables-alpha.TableProps": {
       "assembly": "@aws-cdk/aws-s3tables-alpha",
       "datatype": true,
@@ -6318,7 +6730,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/table.ts",
-        "line": 55
+        "line": 186
       },
       "name": "TableProps",
       "properties": [
@@ -6331,7 +6743,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 63
+            "line": 194
           },
           "name": "namespace",
           "type": {
@@ -6348,7 +6760,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 67
+            "line": 198
           },
           "name": "openTableFormat",
           "type": {
@@ -6364,7 +6776,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 59
+            "line": 190
           },
           "name": "tableName",
           "type": {
@@ -6382,7 +6794,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 73
+            "line": 204
           },
           "name": "compaction",
           "optional": true,
@@ -6400,7 +6812,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 78
+            "line": 209
           },
           "name": "icebergMetadata",
           "optional": true,
@@ -6418,7 +6830,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 89
+            "line": 220
           },
           "name": "removalPolicy",
           "optional": true,
@@ -6436,7 +6848,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 83
+            "line": 214
           },
           "name": "snapshotManagement",
           "optional": true,
@@ -6455,7 +6867,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table.ts",
-            "line": 97
+            "line": 228
           },
           "name": "withoutMetadata",
           "optional": true,
@@ -6584,6 +6996,6 @@
       "symbolId": "lib/table-bucket:UnreferencedFileRemovalStatus"
     }
   },
-  "version": "2.212.0-alpha.0",
+  "version": "2.213.0-alpha.0",
   "fingerprint": "**********"
 }