> **Experimental**
>
> `@aws-cdk/aws-s3tables-alpha` is an [**experimental**](/stability) (alpha) package: its API may change in any release, without a major version bump.
# TableBucketEncryption

Controls Server Side Encryption (SSE) for this TableBucket.

- Stability: [Experimental](/cdk/api/stability.html)
- Source: [`lib/table-bucket.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0-alpha.0/packages/@aws-cdk/aws-s3tables-alpha/lib/table-bucket.ts#L191)

## Example

```ts
// Provide a user defined KMS Key:
const key = new kms.Key(scope, 'UserKey', {});
const encryptedBucket = new TableBucket(scope, 'EncryptedTableBucket', {
    tableBucketName: 'table-bucket-1',
    encryption: TableBucketEncryption.KMS,
    encryptionKey: key,
});
// This account principal will also receive kms:Decrypt access to the KMS key
encryptedBucket.grantRead(new iam.AccountPrincipal('123456789012'), '*');

// Use S3 managed server side encryption (default)
const encryptedBucketDefault = new TableBucket(scope, 'EncryptedTableBucketDefault', {
    tableBucketName: 'table-bucket-3',
    encryption: TableBucketEncryption.S3_MANAGED, // Uses AES-256 encryption by default
});
```

## Members

| Member | Description |
| --- | --- |
| `KMS` | Use a customer defined KMS key for encryption If `encryptionKey` is specified, this key will be used, otherwise, one will be defined. |
| `S3_MANAGED` | Use S3 managed encryption keys with AES256 encryption. |

## Referenced by

- [`TableBucketProps`](/v2/docs/@aws-cdk_aws-s3tables-alpha.TableBucketProps).encryption