I just found out that when I do a delete_item operation with ReturnValues='ALL_OLD', the entries in the Attributes dict of the response from dynamodb are not decrypted. Looking at the dynamodb encryption sdk code, it looks like delete_item is not handled.

It's a minor issue, but I was wondering if decryption support for 'ALL_OLD' attributes in delete_item responses is planned to be added.