Amazon Lambda durable functions now supports customer managed key encryption
Amazon Lambda durable functions now supports encryption of durable execution data with an Amazon KMS customer managed key. Lambda durable functions is a capability that lets you build long-running, reliable workflows directly in your Lambda function code with automatic state management. Lambda always encrypts execution state at rest and with this launch, you now have the option to choose and manage the encryption key yourself.
If you operate in regulated industries such as financial services or healthcare, your data governance policies may require customer-owned encryption keys. You can now configure a customer managed key for durable execution data, giving you control over key rotation and who can access execution history and state. The durable execution key operates independently of the function-level key that protects environment variables and SnapStart snapshots, so you can manage access to execution data separately from function configuration.
This feature is now generally available Amazon Web Services China (Beijing) Region, operated by Sinnet, and the Amazon Web Services China (Ningxia) Region, operated by NWCD. Standard Amazon KMS charges apply for customer managed keys. There are no additional Lambda charges for this feature.
To learn more, see Encrypting Lambda durable execution data in the Amazon Lambda Developer Guide.