AWS CDK で AWS Lambda のイベントフィルタリング条件の暗号化が可能になっていました

By default, Lambda will encrypt Filter Criteria using AWS managed keys. But if you want to use a self managed KMS key to encrypt the filters, You can specify the self managed key using the `filterEncryption` property.

```ts
import * as eventsources from 'aws-cdk-lib/aws-lambda-event-sources';
import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
import { Key } from 'aws-cdk-lib/aws-kms';

declare const fn: lambda.Function;
const table = new dynamodb.Table(this, 'Table', {
  partitionKey: {
    name: 'id',
    type: dynamodb.AttributeType.STRING,
  },
  stream: dynamodb.StreamViewType.NEW_IMAGE,
});
// Your self managed KMS key
const myKey = Key.fromKeyArn(
  this,
  'SourceBucketEncryptionKey',
  'arn:aws:kms:us-east-1:123456789012:key/<key-id>',
);

fn.addEventSource(new eventsources.DynamoEventSource(table, {
  startingPosition: lambda.StartingPosition.LATEST,
  filters: [lambda.FilterCriteria.filter({ eventName: lambda.FilterRule.isEqual('INSERT') })],
  filterEncryption: myKey,
}));

> Lambda requires allow `kms:Decrypt` on Lambda principal `lambda.amazonaws.com` to use the key for Filter Criteria Encryption. If you create the KMS key in the stack, CDK will automatically add this permission to the Key when you creates eventSourceMapping. However, if you import the key using function like `Key.fromKeyArn` then you need to add the following permission to the KMS key before using it to encrypt Filter Criteria

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "kms:Decrypt",
      "Resource": "*"
    }
  ]
}
```

import {
  Stack,
  RemovalPolicy,
  aws_kms,
  aws_lambda,
  aws_lambda_nodejs,
  aws_lambda_event_sources,
  aws_dynamodb,
} from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class CdkSampleStack extends Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    const myTable = new aws_dynamodb.Table(this, 'MyTable', {
      partitionKey: { name: 'id', type: aws_dynamodb.AttributeType.STRING },
      stream: aws_dynamodb.StreamViewType.OLD_IMAGE,
      removalPolicy: RemovalPolicy.DESTROY,
    });

    const myKey = new aws_kms.Key(this, 'MyKey', {
      removalPolicy: RemovalPolicy.DESTROY,
    });

    const myFunction = new aws_lambda_nodejs.NodejsFunction(this, 'MyFunction');

    myFunction.addEventSource(
      new aws_lambda_event_sources.DynamoEventSource(myTable, {
        startingPosition: aws_lambda.StartingPosition.LATEST,
        batchSize: 1,
        filters: [
          aws_lambda.FilterCriteria.filter({
            eventName: aws_lambda.FilterRule.isEqual('INSERT'),
          }),
        ],
        filterEncryption: myKey, // カスタマー管理キーを指定
      })
    );
  }
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::300561038900:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "lambda.amazonaws.com"
            },
            "Action": "kms:Decrypt",
            "Resource": "*"
        }
    ]
}

"MyFunctionDynamoDBEventSourceCdkSampleStackMyTable393F30B56FD7A5C7": {
      "Type": "AWS::Lambda::EventSourceMapping",
      "Properties": {
        "BatchSize": 1,
        "EventSourceArn": {
          "Fn::GetAtt": [
            "MyTable794EDED1",
            "StreamArn"
          ]
        },
        "FilterCriteria": {
          "Filters": [
            {
              "Pattern": "{\"eventName\":[\"INSERT\"]}"
            }
          ]
        },
        "FunctionName": {
          "Ref": "MyFunction3BAA72D1"
        },
        "KmsKeyArn": {
          "Fn::GetAtt": [
            "MyKey6AB29FA6",
            "Arn"
          ]
        },
        "MaximumRetryAttempts": 0,
        "StartingPosition": "LATEST"
      },
      "Metadata": {
        "aws:cdk:path": "CdkSampleStack/MyFunction/DynamoDBEventSource:CdkSampleStackMyTable393F30B5/Resource"
      }
    },