# aws/aws-database-encryption-sdk-dynamodb architecture

> Architecture diagram of the GitHub repository aws/aws-database-encryption-sdk-dynamodb, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-23). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/aws/aws-database-encryption-sdk-dynamodb
- Repository: https://github.com/aws/aws-database-encryption-sdk-dynamodb

## Overview

The product is a client-side DynamoDB encryption SDK: applications encrypt selected item attributes before storage and decrypt them within the application. The tree shows Java integration points for DynamoDB clients, enhanced-client configuration, legacy encryption, transforms, and generated Dafny interfaces, plus Java materials providers. The sampled code directly confirms query input/output transform behavior in the test server and Rust materials-manager adaptation; most runtime implementation wiring was not sampled, so uncertain internal call edges are omitted.

Main entry points: [`DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/DynamoDbEncryptionInterceptor.java`](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/DynamoDbEncryptionInterceptor.java) (DynamoDB interceptor), [`DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/providers/EncryptionMaterialsProvider.java`](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/providers/EncryptionMaterialsProvider.java) (Materials providers), [`DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/DynamoDbEnhancedTableEncryptionConfig.java`](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/DynamoDbEnhancedTableEncryptionConfig.java) (Enhanced table config), [`DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/providers/DirectKmsMaterialProvider.java`](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/providers/DirectKmsMaterialProvider.java) (Direct KMS provider)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_integration["DynamoDB integration"]
  node_interceptor["DynamoDB interceptor"]
  node_execution_attribute["Execution attribute"]
  node_enhanced_config["Enhanced table config"]
  node_enhanced_client["Enhanced client"]
  node_attribute_tags["Attribute tags"]
end

subgraph group_crypto["Encryption runtime"]
  node_item_encryptor["Item encryptor"]
  node_legacy_encryptor["Legacy encryptor"]
  node_signer["DynamoDB signer"]
  node_encryption_context["Encryption context"]
  node_query_transforms["Query transforms<br/>[__default.java]"]
  node_branch_key["Branch key supplier"]
end

subgraph group_materials["Key materials"]
  node_materials_provider["Materials providers"]
  node_direct_kms["Direct KMS provider"]
  node_materials["Cryptographic materials"]
  node_providers_cache["Caching provider"]
end

subgraph group_interfaces["Dafny interfaces"]
  node_dafny_dynamodb["DynamoDB interfaces<br/>[__default.java]"]
  node_dafny_item["Item interfaces<br/>[__default.java]"]
  node_dafny_structured["Structured interfaces<br/>[__default.java]"]
end

node_application(("Application"))
node_dynamodb[("DynamoDB")]
node_kms["AWS KMS"]

node_application -->|"uses"| node_interceptor
node_interceptor -->|"intercepts requests"| node_dynamodb
node_application -->|"configures tables"| node_enhanced_client
node_enhanced_config -->|"defines handling"| node_attribute_tags
node_application -.->|"may use legacy API"| node_legacy_encryptor
node_materials_provider -->|"supplies materials"| node_materials
node_direct_kms -.->|"uses optionally"| node_kms
node_providers_cache -->|"caches provider"| node_materials_provider

click node_interceptor "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/DynamoDbEncryptionInterceptor.java"
click node_execution_attribute "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/DynamoDbEncryptionExecutionAttribute.java"
click node_enhanced_config "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/DynamoDbEnhancedTableEncryptionConfig.java"
click node_enhanced_client "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/DynamoDbEnhancedClientEncryption.java"
click node_attribute_tags "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/EncryptionAttributeTags.java"
click node_item_encryptor "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/smithy-generated/software/amazon/cryptography/dbencryptionsdk/dynamodb/itemencryptor/DynamoDbItemEncryptor.java"
click node_legacy_encryptor "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/DynamoDBEncryptor.java"
click node_signer "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/DynamoDbSigner.java"
click node_encryption_context "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/EncryptionContext.java"
click node_query_transforms "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/transforms/internaldafny/__default.java"
click node_materials_provider "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/providers/EncryptionMaterialsProvider.java"
click node_direct_kms "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/providers/DirectKmsMaterialProvider.java"
click node_materials "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/materials/CryptographicMaterials.java"
click node_providers_cache "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/providers/CachingMostRecentProvider.java"
click node_branch_key "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/smithy-generated/software/amazon/cryptography/dbencryptionsdk/dynamodb/DynamoDbKeyBranchKeyIdSupplier.java"
click node_dafny_dynamodb "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/internaldafny/__default.java"
click node_dafny_item "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/itemencryptor/internaldafny/__default.java"
click node_dafny_structured "https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/structuredencryption/internaldafny/__default.java"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_interceptor,node_execution_attribute,node_enhanced_config,node_enhanced_client,node_attribute_tags toneBlue
class node_item_encryptor,node_legacy_encryptor,node_signer,node_encryption_context,node_query_transforms,node_branch_key,node_dynamodb toneAmber
class node_materials_provider,node_direct_kms,node_materials,node_providers_cache toneMint
class node_dafny_dynamodb,node_dafny_item,node_dafny_structured toneRose
class node_application,node_kms toneIndigo
```

## Components

### DynamoDB integration

- [DynamoDB interceptor](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/DynamoDbEncryptionInterceptor.java): `DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/DynamoDbEncryptionInterceptor.java`
- [Execution attribute](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/DynamoDbEncryptionExecutionAttribute.java): `DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/DynamoDbEncryptionExecutionAttribute.java`
- [Enhanced table config](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/DynamoDbEnhancedTableEncryptionConfig.java): `DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/DynamoDbEnhancedTableEncryptionConfig.java`
- [Enhanced client](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/DynamoDbEnhancedClientEncryption.java): `DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/DynamoDbEnhancedClientEncryption.java`
- [Attribute tags](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/EncryptionAttributeTags.java): `DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/enhancedclient/EncryptionAttributeTags.java`

### Encryption runtime

- [Item encryptor](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/smithy-generated/software/amazon/cryptography/dbencryptionsdk/dynamodb/itemencryptor/DynamoDbItemEncryptor.java): `DynamoDbEncryption/runtimes/java/src/main/smithy-generated/software/amazon/cryptography/dbencryptionsdk/dynamodb/itemencryptor/DynamoDbItemEncryptor.java`
- [Legacy encryptor](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/DynamoDBEncryptor.java): `DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/DynamoDBEncryptor.java`
- [DynamoDB signer](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/DynamoDbSigner.java): `DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/DynamoDbSigner.java`
- [Encryption context](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/EncryptionContext.java): `DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/EncryptionContext.java`
- [Query transforms](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/transforms/internaldafny/__default.java): `DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/transforms/internaldafny/__default.java`
- [Branch key supplier](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/smithy-generated/software/amazon/cryptography/dbencryptionsdk/dynamodb/DynamoDbKeyBranchKeyIdSupplier.java): `DynamoDbEncryption/runtimes/java/src/main/smithy-generated/software/amazon/cryptography/dbencryptionsdk/dynamodb/DynamoDbKeyBranchKeyIdSupplier.java`

### Key materials

- [Materials providers](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/providers/EncryptionMaterialsProvider.java): `DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/providers/EncryptionMaterialsProvider.java`
- [Direct KMS provider](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/providers/DirectKmsMaterialProvider.java): `DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/providers/DirectKmsMaterialProvider.java`
- [Cryptographic materials](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/materials/CryptographicMaterials.java): `DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/materials/CryptographicMaterials.java`
- [Caching provider](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/providers/CachingMostRecentProvider.java): `DynamoDbEncryption/runtimes/java/src/main/sdkv2/com/amazonaws/services/dynamodbv2/datamodeling/sdkv2/encryption/providers/CachingMostRecentProvider.java`

### Dafny interfaces

- [DynamoDB interfaces](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/internaldafny/__default.java): `DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/internaldafny/__default.java`
- [Item interfaces](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/itemencryptor/internaldafny/__default.java): `DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/dynamodb/itemencryptor/internaldafny/__default.java`
- [Structured interfaces](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/structuredencryption/internaldafny/__default.java): `DynamoDbEncryption/runtimes/java/src/main/java/software/amazon/cryptography/dbencryptionsdk/structuredencryption/internaldafny/__default.java`

### Other components

- **Application**
- **DynamoDB**
- **AWS KMS**

## Connections

- Application → DynamoDB interceptor: uses
- DynamoDB interceptor → DynamoDB: intercepts requests
- Application → Enhanced client: configures tables
- Enhanced table config → Attribute tags: defines handling
- Application → Legacy encryptor: may use legacy API
- Materials providers → Cryptographic materials: supplies materials
- Direct KMS provider → AWS KMS: uses optionally
- Caching provider → Materials providers: caches provider