The textractAsyncSNS topic is unencrypted by default, and has no provisions for providing a masterKey parameter to the encapsulated sns.Topic. Adding support for encryption via this parameter would be a straightforward security win and is line with best practices for using SNS. See:

• https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html
• https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-sns.Topic.html#masterkey