New featureMedium

Amazon CloudWatch Synthetics now supports customer managed encryption keys

Amazon CloudWatch Synthetics now allows the use of customer-managed AWS KMS keys to encrypt canary environment variables, providing enhanced control over sensitive configuration data encryption.

Amazon CloudWatch Synthetics now supports customer-managed AWS Key Management Service (KMS) keys for encrypting canary environment variables. This gives users full control over the encryption of sensitive configuration data such as API keys, credentials, and tokens. Previously, environment variables were encrypted at rest using only an AWS-owned key. Now, in addition to the default AWS-owned key, users can specify their own symmetric KMS key for encryption at rest. Users can also encrypt individual values client-side before storage, and their canary script decrypts them at runtime using the AWS KMS Decrypt API. This feature benefits teams in regulated industries that require organizational key management policies, auditability, or key rotation controls across all services. Amazon CloudWatch Synthetics customer-managed key encryption is available in all commercial AWS Regions, and multi-location canaries can use a different KMS key per replica Region.

Read the original AWS announcement

Related articles and terms

AWS KMSA managed encryption key service for securely creating and managing keys used to encrypt dataWhere Are KMS Encryption Keys Stored? - How Envelope Encryption and HSMs WorkThis article explains how KMS master keys are stored inside FIPS 140-2 certified HSMs, how envelope encryption provides double protection for data keys, and the internal workings of key rotation.AWS Encryption and Data Sovereignty - Hardware-Level Isolation from KMS to Nitro EnclavesWe explain hardware-level encryption and data sovereignty assurance through AWS KMS, CloudHSM, and Nitro Enclaves, and compare design differences with other cloud providers.AWS CloudHSMA service that provides dedicated FIPS 140-2 Level 3 certified hardware security modules for generating, storing, and performing cryptographic operations with encryption keys in the cloudAmazon EBS Encryption and Snapshot Sharing - Cross-Account and Cross-Region DesignA comprehensive guide covering default encryption setup, cross-account snapshot sharing, and cross-region copy for DR design.