--- title: AWS Lambda durable functions now supports customer... description: AWS Lambda durable functions now supports customer managed key (CMK) encryption via AWS KMS for durable execution data. Previously, Lambda encrypted execution... canonical: https://daily.dev/posts/aws-lambda-durable-functions-now-supports-customer-managed-key-encryption-ctxddmlyr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AWS Lambda durable functions now supports customer managed key encryption | daily.dev og:description: AWS Lambda durable functions now supports customer managed key (CMK) encryption via AWS KMS for durable execution data. Previously, Lambda encrypted execution... og:url: https://daily.dev/posts/aws-lambda-durable-functions-now-supports-customer-managed-key-encryption-ctxddmlyr og:image: https://api.daily.dev/og/posts/cTXddMlYr.png og:image:alt: AWS Lambda durable functions now supports customer managed key encryption og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AWS Lambda durable functions now supports customer managed key encryption **[AWS](https://daily.dev/sources/aws)** · 2 min read · 0 upvotes · 0 comments ## Summary AWS Lambda durable functions now supports customer managed key (CMK) encryption via AWS KMS for durable execution data. Previously, Lambda encrypted execution state at rest using an AWS owned key only. With this update, users in regulated industries like financial services or healthcare can configure their own KMS keys, enabling control over key rotation and access to execution history and state. The durable execution key operates independently from the function-level key used for environment variables and SnapStart snapshots. The feature is available in all regions where Lambda durable functions is supported, with standard KMS charges applying. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Can I use my own AWS KMS key to encrypt Lambda durable functions execution data? Yes, AWS Lambda durable functions now supports encrypting execution state at rest with a customer managed AWS KMS key instead of the default AWS owned key. This lets you control key rotation and who can access execution history and state, which matters for regulated industries like financial services or healthcare. Standard AWS KMS charges apply, but there are no additional Lambda charges for the feature. _Teams enforcing key-management compliance for serverless workloads track AWS releases like this via daily.dev._ ### Is the encryption key for Lambda durable execution data the same as the function-level key? No, the durable execution key operates independently of the function-level key that protects environment variables and SnapStart snapshots. This separation lets you manage access to execution data differently from function configuration, which is useful when different teams or policies govern runtime state versus deployment config. _Engineers structuring key access policies for Lambda workflows can follow encryption changes like this on daily.dev._ ## Similar posts on daily.dev - [SageMaker MLflow now supports customer managed keys](https://daily.dev/posts/sagemaker-mlflow-now-supports-customer-managed-keys-zvgehf2nq) · AWS · 0 upvotes · 0 comments - [Take Control: Customer-Managed Keys for Lakebase Postgres](https://daily.dev/posts/take-control-customer-managed-keys-for-lakebase-postgres-urvwpz1do) · databricks · 0 upvotes · 0 comments - [Quick Research now supports customer managed keys](https://daily.dev/posts/quick-research-now-supports-customer-managed-keys-k6v5vkhzb) · AWS · 0 upvotes · 0 comments - [Weighing the benefits of AWS Lambda’s durable functions](https://daily.dev/posts/weighing-the-benefits-of-aws-lambda-s-durable-functions-qmmbps0ur) · InfoWorld · 0 upvotes · 0 comments - [Bring Your Own Key \(BYOK\): AWS IAM Identity Center Adopts CMKs to Meet Enterprise Compliance Needs](https://daily.dev/posts/bring-your-own-key-byok-aws-iam-identity-center-adopts-cmks-to-meet-enterprise-compliance-needs-xbvookuzs) · InfoQ · 0 upvotes · 0 comments --- Tags: [#serverless](https://daily.dev/tags/serverless), [#encryption](https://daily.dev/tags/encryption), [#aws-lambda](https://daily.dev/tags/aws-lambda) [View this post on daily.dev](https://daily.dev/posts/aws-lambda-durable-functions-now-supports-customer-managed-key-encryption-ctxddmlyr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AWS Lambda durable functions now supports customer managed key encryption","url":"https://daily.dev/posts/aws-lambda-durable-functions-now-supports-customer-managed-key-encryption-ctxddmlyr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/aws-lambda-durable-functions-now-supports-customer-managed-key-encryption-ctxddmlyr"},"datePublished":"2026-07-22T20:06:52.990Z","dateModified":"2026-09-14T07:39:01.727Z","description":"AWS Lambda durable functions now supports customer managed key (CMK) encryption via AWS KMS for durable execution data. Previously, Lambda encrypted execution...","image":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","thumbnailUrl":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","isAccessibleForFree":true,"articleSection":"AWS","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"AWS","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/aws","url":"https://daily.dev/sources/aws"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/aws-lambda-durable-functions-now-supports-customer-managed-key-encryption-ctxddmlyr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"serverless,encryption,aws-lambda","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"AWS","item":"https://daily.dev/sources/aws"},{"@type":"ListItem","position":3,"name":"AWS Lambda durable functions now supports customer managed key encryption"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/aws-lambda-durable-functions-now-supports-customer-managed-key-encryption-ctxddmlyr#faq","mainEntity":[{"@type":"Question","name":"Can I use my own AWS KMS key to encrypt Lambda durable functions execution data?","acceptedAnswer":{"@type":"Answer","text":"Yes, AWS Lambda durable functions now supports encrypting execution state at rest with a customer managed AWS KMS key instead of the default AWS owned key. This lets you control key rotation and who can access execution history and state, which matters for regulated industries like financial services or healthcare. Standard AWS KMS charges apply, but there are no additional Lambda charges for the feature. Teams enforcing key-management compliance for serverless workloads track AWS releases like this via daily.dev."}},{"@type":"Question","name":"Is the encryption key for Lambda durable execution data the same as the function-level key?","acceptedAnswer":{"@type":"Answer","text":"No, the durable execution key operates independently of the function-level key that protects environment variables and SnapStart snapshots. This separation lets you manage access to execution data differently from function configuration, which is useful when different teams or policies govern runtime state versus deployment config. Engineers structuring key access policies for Lambda workflows can follow encryption changes like this on daily.dev."}}]} ```