CloudWatch Synthetics Canary Environment Variables Can Now Be Encrypted With Your Own Key!

Hi everyone, it's Shiichan! Today I've got news about Amazon CloudWatch Synthetics — canaries can now protect their secrets with your own encryption key.

AWS What's New aws.amazon.com

What was announced?

This comes from AWS What's New. Amazon CloudWatch Synthetics now supports customer managed AWS KMS keys for encrypting canary environment variables, giving teams full control over how sensitive configuration data like API keys, credentials, and tokens gets encrypted.

The story so far

Until now, canary environment variables were encrypted at rest using only an AWS owned key. That was secure, but teams in regulated industries who needed their own key management policies, auditability, or rotation controls across services didn't have much room to customize it.

What changes

Now you can specify your own symmetric KMS key when creating or updating a canary, and CloudWatch Synthetics uses a grant on that key to handle encryption and decryption transparently behind the scenes.

You can also encrypt values client-side before they're stored, then have your canary script decrypt them at runtime using the AWS KMS Decrypt API. That's great news if your team wants to run key management, auditing, and rotation entirely under your own policies.

Dive Deep

For multi-location canaries, you can even use a different KMS key per replica Region — handy if you need region-specific key management policies. The feature is available in all commercial AWS Regions.

Wrap-up

• CloudWatch Synthetics canary environment variables can now be encrypted with your own KMS customer managed key
• Encryption at rest is handled transparently via a grant, and client-side encryption plus a runtime Decrypt API is also supported
• Multi-location canaries can use a different key per replica Region
• Available in all commercial AWS Regions

If your infrastructure team has strict key management or audit requirements, this update is for you.