Building on prior service-side support, AWS extended hybrid post-quantum TLS key exchange to Secrets Manager clients including Agents, Lambda Extensions, and SDKs in languages like Rust, Go, and Python. The ML-KEM-based key exchange protects secrets retrieval against current cryptographic attacks and future quantum decryption threats without requiring code changes.
This enhancement aims to prevent 'harvest now, decrypt later' risks by combining classical key exchange mechanisms with quantum-resistant algorithms transparently. Customers can verify the hybrid key exchange use via CloudTrail logs reflecting the ML-KEM algorithm during secret requests.
Source & further reading
AWS Secrets Manager clients now support hybrid post-quantum TLS to protect secrets from quantum risks ↗Source published 2026-04-14. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.