fix(dynamodb): cannot change serverSideEncryption from true to false

When a table was deployed with `serverSideEncryption` set to `true` (by
requesting `AWS_MANAGED` or `CUSTOM` server side encryption), it was not
possible to switch back to `DEFAULT` as this could drop the
`serverSideEncryption` configuration altogether, which CloudFormation
will not allow.

This changes makes `Table` continue to not set the
`serverSideEncryption` configuration if nothing was configured (the user
chose the implicit default behavior), but to actually set the value
explicitly to `false` if the user *explicitly* requests `DEFAULT`
encryption.

This makes it possible to flip away from `AWS_MANAGED` and `CUSTOM`
encryption to the cheaper alternative that is `DEFAULT`.

Fixes #8286

packages/@aws-cdk/aws-dynamodb/lib/table.ts

@@ -1334,8 +1334,8 @@ export class Table extends TableBase {
       encryptionType = props.encryptionKey != null
         // If there is a configured encyptionKey, the encryption is implicitly CUSTOMER_MANAGED
         ? TableEncryption.CUSTOMER_MANAGED
-        // Otherwise, if severSideEncryption is enabled, it's AWS_MANAGED; else DEFAULT
-        : props.serverSideEncryption ? TableEncryption.AWS_MANAGED : TableEncryption.DEFAULT;
+        // Otherwise, if severSideEncryption is enabled, it's AWS_MANAGED; else undefined (do not set anything)
+        : props.serverSideEncryption ? TableEncryption.AWS_MANAGED : undefined;
     }
 
     if (encryptionType !== TableEncryption.CUSTOMER_MANAGED && props.encryptionKey) {
@@ -1363,6 +1363,9 @@ export class Table extends TableBase {
         return { sseSpecification: { sseEnabled: true } };
 
       case TableEncryption.DEFAULT:
+        return { sseSpecification: { sseEnabled: false } };
+
+      case undefined:
         // Not specifying "sseEnabled: false" here because it would cause phony changes to existing stacks.
         return { sseSpecification: undefined };
 

packages/@aws-cdk/aws-dynamodb/test/integ.dynamodb.sse.expected.json

@@ -507,6 +507,9 @@
         "ProvisionedThroughput": {
           "ReadCapacityUnits": 5,
           "WriteCapacityUnits": 5
+        },
+        "SSESpecification": {
+          "SSEEnabled": false
         }
       },
       "UpdateReplacePolicy": "Delete",