Previously, CloudWatch Synthetics encrypted environment variables at rest using only AWS-owned keys, limiting user control. The update introduced options to specify symmetric KMS keys managed by customers for encryption at rest, alongside client-side encryption where values are encrypted before storage and decrypted at runtime via AWS KMS Decrypt API.
This development particularly benefits regulated organizations requiring strict key management, auditability, and rotation policies. Multi-region canaries can also utilize distinct KMS keys per replica, increasing flexibility. The feature was made available across all commercial AWS regions without added cost.
Source & further reading
Amazon CloudWatch Synthetics now supports customer managed encryption keys ↗Source published 2026-07-16. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.