AWS Lambda durable functions now supports customer managed key encryption

AWS Lambda durable functions now supports encryption of durable execution data using AWS Key Management Service (AWS KMS) customer managed keys. Previously, Lambda encrypted execution state at rest by default with an AWS owned key. With this update, users can select and manage their own encryption keys. This is particularly useful for regulated industries such as financial services or healthcare, where data governance policies may require customer-owned encryption keys. The durable execution key operates independently of the function-level key that protects environment variables and SnapStart snapshots, allowing separate management of execution data access. The feature is available in all AWS Regions where Lambda durable functions are offered. Standard AWS KMS charges apply for customer managed keys, with no additional Lambda charges for this feature.