AWS Lambda Durable Functions Gains Customer Managed Key Support for Encrypted Execution Data

AWS Lambda durable functions now support encryption of execution state data at rest using customer-managed AWS KMS keys, enhancing data governance and security control.

By Victor Hale · Editorial pseudonym · 2026-07-22 · 1 min read

AI-ASSISTED REPORTING · RETROSPECTIVE ARCHIVE

Retrospective edition: 2026-07-22. Source published: 2026-07-22. Added to this archive: 2026-11-03. This briefing was prepared later from the linked announcement; it was not published on this website on the historical edition date.

Durable functions automatically manage state for long-running workflows. While state data was encrypted with AWS-owned keys by default, customers in regulated sectors can now specify managed keys to control rotation and access, aligning with compliance requirements.

The feature segregates execution data encryption from function-level key management for environment variables and SnapStart snapshots, allowing separate access policies. It is available in all AWS Regions offering durable functions, with standard KMS charges applying but no extra Lambda costs.

Source & further reading

AWS Lambda durable functions now supports customer managed key encryption ↗

Source published 2026-07-22. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.