dynamodb-encryption-sdk

What it is and what it does

The DynamoDB Encryption Client for Python is an AWS-provided library that adds client-side encryption to DynamoDB operations. It wraps boto3's DynamoDB client, resource, and table interfaces to transparently encrypt items before they reach DynamoDB and decrypt them on retrieval. The library supports attribute-level encryption and signing, allowing you to protect sensitive data while still querying unencrypted attributes.

The package provides two usage patterns: helper clients (EncryptedClient, EncryptedResource, EncryptedTable) that act as drop-in replacements for boto3 equivalents, and low-level item encryptor functions for advanced use cases like processing DynamoDB Streams. It depends on boto3 for AWS communication, cryptography for encryption primitives, and attrs for internal data structures. Note that the helper clients intentionally block update_item and attribute filtering operations to prevent signature validation failures from partial updates or missing signed attributes.

Use it for:

• Protect sensitive DynamoDB table data (PII, financial records) before it leaves your application
• Comply with data protection regulations by encrypting items client-side before storage in managed AWS services
• Decrypt items from DynamoDB Streams for processing while maintaining encryption at rest
• Build multi-tenant applications where each tenant's data is encrypted with separate keys
• Migrate encrypted data between DynamoDB tables while preserving encryption boundaries

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Encrypts and decrypts DynamoDB items client-side before transmission, using boto3 as a transparent wrapper with support for attribute-level encryption and cryptographic key management.

Yes. This is an actively maintained, production-stable AWS library with no known vulnerabilities, low install friction, and permissive licensing. Install it if you need client-side encryption for DynamoDB items. Be aware that helper clients intentionally restrict update_item and attribute filtering to prevent signature validation failures—review the documentation to confirm this aligns with your access patterns.

Install

dynamodb-encryption-sdk on PyPI

pip install dynamodb-encryption-sdk

uv add dynamodb-encryption-sdk

poetry add dynamodb-encryption-sdk

Installing dynamodb-encryption-sdk

Before you install

Low friction: pure Python wheel with three stable runtime dependencies (boto3, cryptography, attrs). Repository is active with recent commits and no archived status.

License in practice

Apache License 2.0 (permissive): you may use, modify, and distribute this package freely in commercial and private projects, provided you include the license notice.

Quickstart

pip install dynamodb-encryption-sdk

from dynamodb_encryption_sdk.encrypted.item import encrypt_python_item, decrypt_python_item

encrypted_item = encrypt_python_item(
    item={'some': 'data', 'more': 5},
    crypto_config=my_crypto_config
)
decrypted_item = decrypt_python_item(
    item=encrypted_item,
    crypto_config=my_crypto_config
)

Requires cryptography package; see cryptography installation guide for OS-specific prerequisites. Requires Python 3.8+.

Verify before relying

• Whether the package supports all boto3 DynamoDB operations or only a documented subset beyond put/get/scan/batch operations
• Performance overhead of client-side encryption relative to unencrypted boto3 calls
• Compatibility guarantees with specific boto3 versions or AWS SDK updates

Package facts

Evidence: dynamodb_encryption_sdk-3.3.0-py2.py3-none-any.whl

Keywords: dynamodb-encryption-sdk, aws, kms, encryption, dynamodb

Tags

More Security packages