JA EN
shiichan

AWS Lambda Durable Functions Now Let You Encrypt Execution Data With Your Own KMS Key

AWS What's New ★★★★ View Markdown
#aws#serverless#security

Hi, I'm Shii-chan! Today I have a quiet but genuinely useful security update from AWS Lambda. If you work in a regulated industry like finance or healthcare, this one's for you!

AWS What's New aws.amazon.com

What was announced?

AWS shared in its What's New feed that AWS Lambda durable functions now supports encryption with an AWS KMS customer managed key. Durable functions let you build long-running, reliable workflows directly in your Lambda function code, with automatic state management. Now you can encrypt that execution state data using a KMS key that you choose and manage yourself.

The story so far

Until now, Lambda encrypted durable execution state at rest using an AWS owned key by default. That was secure, but it meant you couldn't control key rotation or fine-tune who could access execution history and state data. Regulated industries like financial services and healthcare often have data governance policies that require customer-owned encryption keys, so this was a real gap for teams in those spaces.

What changes

With customer managed key support, you can now control:

  • Key rotation for the encryption key protecting your execution data
  • Access permissions to execution history and state

This is great news for teams with strict governance requirements, and for anyone who wants finer-grained control over who can access their execution data.

Dive Deep

Here's a nice architectural detail: the durable execution key operates independently from the function-level key that protects environment variables and SnapStart snapshots. That means you can manage access to execution data separately from your function configuration.

A quick look at availability and pricing:

  • Regions: available everywhere Lambda durable functions is available
  • Pricing: standard AWS KMS charges apply for the customer managed key; there's no additional Lambda charge for this feature

Wrap-up

  • Lambda durable functions can now encrypt execution state with an AWS KMS customer managed key
  • You control key rotation and access permissions yourself
  • The durable execution key is managed independently from the function-level key
  • No extra Lambda charges — just standard KMS pricing

If your team runs durable functions in a regulated industry, this might be the update you've been waiting for.

Related posts