---
id: dynamodb-encryption-sdk
version: "3.3.0"
license: Apache License 2.0
license_treatment: permissive
maintenance: active
---

# dynamodb-encryption-sdk — DynamoDB Encryption Client for Python

License: permissive · Maintenance: active · Downloads: 131.1K/mo

## What it is and what it does

The DynamoDB Encryption Client for Python is an AWS-provided library that adds client-side encryption to DynamoDB operations. It wraps boto3's DynamoDB client, resource, and table interfaces to transparently encrypt items before they reach DynamoDB and decrypt them on retrieval. The library supports attribute-level encryption and signing, allowing you to protect sensitive data while still querying unencrypted attributes.

The package provides two usage patterns: helper clients (EncryptedClient, EncryptedResource, EncryptedTable) that act as drop-in replacements for boto3 equivalents, and low-level item encryptor functions for advanced use cases like processing DynamoDB Streams. It depends on boto3 for AWS communication, cryptography for encryption primitives, and attrs for internal data structures. Note that the helper clients intentionally block update_item and attribute filtering operations to prevent signature validation failures from partial updates or missing signed attributes.

Use it for:

- Protect sensitive DynamoDB table data (PII, financial records) before it leaves your application
- Comply with data protection regulations by encrypting items client-side before storage in managed AWS services
- Decrypt items from DynamoDB Streams for processing while maintaining encryption at rest
- Build multi-tenant applications where each tenant's data is encrypted with separate keys
- Migrate encrypted data between DynamoDB tables while preserving encryption boundaries

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Encrypts and decrypts DynamoDB items client-side before transmission, using boto3 as a transparent wrapper with support for attribute-level encryption and cryptographic key management.

Yes. This is an actively maintained, production-stable AWS library with no known vulnerabilities, low install friction, and permissive licensing. Install it if you need client-side encryption for DynamoDB items. Be aware that helper clients intentionally restrict update_item and attribute filtering to prevent signature validation failures—review the documentation to confirm this aligns with your access patterns.

## Install

pip install dynamodb-encryption-sdk
uv add dynamodb-encryption-sdk
poetry add dynamodb-encryption-sdk

## Installing dynamodb-encryption-sdk

Before you install: Low friction: pure Python wheel with three stable runtime dependencies (boto3, cryptography, attrs). Repository is active with recent commits and no archived status.

License in practice: Apache License 2.0 (permissive): you may use, modify, and distribute this package freely in commercial and private projects, provided you include the license notice.

Quickstart:

pip install dynamodb-encryption-sdk

from dynamodb_encryption_sdk.encrypted.item import encrypt_python_item, decrypt_python_item

encrypted_item = encrypt_python_item(
    item={'some': 'data', 'more': 5},
    crypto_config=my_crypto_config
)
decrypted_item = decrypt_python_item(
    item=encrypted_item,
    crypto_config=my_crypto_config
)

Requires cryptography package; see cryptography installation guide for OS-specific prerequisites. Requires Python 3.8+.

Verify before relying:

- Whether the package supports all boto3 DynamoDB operations or only a documented subset beyond put/get/scan/batch operations
- Performance overhead of client-side encryption relative to unencrypted boto3 calls
- Compatibility guarantees with specific boto3 versions or AWS SDK updates

## Package facts

- License: Apache License 2.0 (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: active
- Downloads: 131.1K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

dynamodb client-side encryption, encrypt dynamodb items python, aws dynamodb encryption sdk, dynamodb data protection, boto3 encrypted wrapper, dynamodb cryptography, attribute-level encryption dynamodb, aws-dynamodb, client-side-encryption, key-management

[View on SkillFed](https://skillfed.io/packages/dynamodb-encryption-sdk) · [View on PyPI](https://pypi.org/project/dynamodb-encryption-sdk/)