resource "aws_dynamodb_table" "vault" {
  name         = "vault-dynamodb"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "Path"
  range_key    = "Key"

  #checkov:skip=CKV_AWS_119:Encrypted by AWS Owned key config'd via console
  # tfsec:ignore:aws-dynamodb-table-customer-key AWS Owned key config'd via console
  # tfsec:ignore:aws-dynamodb-enable-at-rest-encryption False positive
  server_side_encryption {
    enabled = false
  }

  attribute {
    name = "Path"
    type = "S"
  }

  attribute {
    name = "Key"
    type = "S"
  }

  point_in_time_recovery {
    enabled = true
  }

  tags = merge(local.standard_tags, var.tags)
}