# Timestream for InfluxDB now supports encryption with your own KMS key!

Hey, it's me! Today's update is about security for Amazon Timestream for InfluxDB.

## What was announced?

AWS What's New announced that Amazon Timestream for InfluxDB now supports AWS Key Management Service (AWS KMS) customer managed keys for encrypting data at rest. This covers InfluxDB 2 database instances and read replicas, as well as InfluxDB 3 clusters.

## The story so far

Timestream for InfluxDB already encrypted data at rest, but you couldn't choose your own customer managed key for it. Some organizations need full control over the lifecycle and access permissions of their encryption keys, and that requirement was hard to meet without customer managed key support.

## What changes

Now you just pick a symmetric AWS KMS key when creating a database resource, and Timestream for InfluxDB uses it to encrypt the underlying database storage. You can configure this through the AWS Management Console, the AWS CLI, or the Timestream for InfluxDB API.

## Dive Deep

A few constraints worth knowing:

- The KMS key must be in the same AWS account and Region as the database resource
- You choose the key at resource creation time, and it can't be changed afterward
- There's no additional Timestream for InfluxDB charge — standard AWS KMS charges apply
- Available in every Region where Timestream for InfluxDB is available

## Wrap-up

- Timestream for InfluxDB now supports AWS KMS customer managed keys
- Covers InfluxDB 2 instances/read replicas and InfluxDB 3 clusters
- The key is chosen at creation time and can't be changed later
- No extra Timestream charge, just standard KMS pricing

If your team needs to own its encryption keys for compliance reasons, this update has been a long time coming!