AWS Secrets Manager now supports hybrid post-quantum TLS to protect secrets from quantum threats

AWS Secrets Manager Hybrid Post-Quantum Key Exchange Support

AWS Secrets Manager now supports hybrid post-quantum key exchange using ML-KEM to secure TLS connections for retrieving and managing secrets. This feature is automatically enabled in Secrets Manager Agent (version 2.0.0+), AWS Lambda Extension (version 19+), and Secrets Manager CSI Driver (version 2.0.0+). For SDK-based clients, it is available in supported AWS SDKs including Rust, Go, Node.js, Kotlin, Python (with OpenSSL 3.5+), and Java v2 (v2.35.11+).

This update helps protect against both traditional cryptographic attacks and future quantum computing threats. No code changes, configuration updates, or migration effort are required for customers using the latest client versions except for Java v2. You can verify hybrid post-quantum key exchange is active by checking CloudTrail logs for the "X25519MLKEM768" key exchange algorithm in the tlsDetails field of GetSecretValue API calls.

What to do

• Upgrade to the latest Secrets Manager Agent version to enable hybrid post-quantum key exchange.
• Verify the key exchange algorithm in CloudTrail logs.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.