service
AWS KMS: security advisories, deprecations and releases
Managed encryption keys on AWS.
- Items, 90 days
- 4
- Critical
- 0
- Last critical
- none
- This week
- 0
Releases 1
- INFO AWS What's New · 26 Oct 2026
AWS KMS adds ML-KEM post-quantum key encapsulation
KMS now supports ML-KEM-512/768/1024 for quantum-resistant key exchange in all commercial regions except UAE, Bahrain, and China.
News and tools 3
- HIGH AWS Security Blog · 12 Oct 2026
Quantum-resistant signing on AWS Part 1: ML-DSA software supply chain
AWS shows how to build an end-to-end ML-DSA-based signing pipeline using KMS, Private CA, and IAM Roles Anywhere to protect against future quantum forgery of software artifacts.
- INFO AWS Security Blog · 12 Oct 2026
Quantum-resistant signing on AWS, Part 2: Enforce your ML-DSA algorithm policy with SCPs and IAM
Shows how to turn an organization’s approved ML-DSA parameter sets into enforceable preventive and detective controls on AWS using SCPs, IAM policies, permission boundaries, and detection.
- MEDIUM AWS Security Blog · 2 Oct 2026
KMS data-key caching patterns for multi-tenant systems
Two new patterns (hierarchical keyring, Caffeine cache) prevent cache-stampede when encrypting high-throughput, multi-tenant event streams with AWS KMS.
Only hear about AWS KMS when it touches your stack
Tell Zero what you run. You get one email, and only on the days something above applies to you.