By integrating customer managed keys, organizations gain authority over key lifecycle, permissions, and access revocation, beyond default AWS owned keys. This capability supports compliance with internal governance policies and regulatory requirements for data protection.
Users can apply customer managed keys when creating or updating user pools and monitor key usage through AWS CloudTrail for audit and visibility. This flexibility in data encryption aligns Cognito with enterprise security best practices and controls, with no additional Cognito fees aside from standard KMS charges.
Source & further reading
Amazon Cognito now supports customer managed key for encryption at rest ↗Source published 2026-06-23. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.