JA EN
shiichan

Did You Know Amazon Transcribe Now Lets You Encrypt Custom Resources with Your Own Key?

AWS What's New ★★ View Markdown
#aws#security#ai

Hi everyone, it's me, Shii-chan! I found a security update for Amazon Transcribe today, and I got a little bit excited about it!

AWS What's New aws.amazon.com

What was announced?

This comes straight from AWS What's New: Amazon Transcribe now lets you encrypt your "custom resources" with a customer-managed AWS KMS key. The resources covered are:

  • Custom vocabularies
  • Custom vocabulary filters
  • Custom language models

When you create or update one of these resources, you can now supply your own symmetric AWS KMS key.

The story so far

Until now, these custom resources could only be encrypted with an AWS owned key. That meant key management was entirely in AWS's hands, and you couldn't control the permissions or access around the encryption key yourself. For teams with strict compliance requirements, I think that was a real gap.

What changes

With a customer-managed key, you get:

  • Full control over key permissions, so you decide exactly which principals and services can encrypt and decrypt your custom resources
  • A complete audit trail, since every use of your key is logged in AWS CloudTrail for compliance and monitoring
  • The ability to disable the key or move resources to a different key, so you can revoke access on your own schedule

If you work in a regulated industry like finance or healthcare, this is a quiet but genuinely useful upgrade!

Dive Deep

This feature is opt-in: if you don't supply a key, your resources keep being encrypted with an AWS owned key just like before, so there's nothing you have to do. The announcement doesn't mention any additional pricing for this feature.

It's available in all AWS Regions where Amazon Transcribe is offered, and more setup details are in the Amazon Transcribe Developer Guide.

Wrap-up

  • Amazon Transcribe custom vocabularies, custom vocabulary filters, and custom language models can now be encrypted with a customer-managed AWS KMS key
  • Previously these resources were always encrypted with an AWS owned key
  • Your own key gives you control over permissions plus a CloudTrail audit trail
  • It's fully opt-in, no key means no change to existing behavior
  • Available across all Regions where Transcribe is offered

If your organization has strict compliance needs or you'd rather own your encryption keys, this one's worth a look!

Related posts