AWS kms medium security documentation change
Summary
Updated documentation to state that AWS KMS now supports hybrid post-quantum TLS on all endpoints including FIPS 140-3 validated endpoints, removing previous restrictions.
Security assessment
The change explicitly enables hybrid post-quantum TLS on FIPS endpoints, which strengthens cryptographic security against quantum computing threats. This directly addresses security posture improvements by expanding support for post-quantum cryptography.
Diff
diff --git a/kms/latest/developerguide/pqtls.md b/kms/latest/developerguide/pqtls.md index 35f74aad1..4821387d7 100644 --- a//kms/latest/developerguide/pqtls.md +++ b//kms/latest/developerguide/pqtls.md @@ -60,5 +60 @@ Use of the hybrid cipher suites in s2n-tls is currently supported only on Linux -When using the hybrid cipher suites, use the standard AWS KMS endpoint. AWS KMS does not support hybrid post-quantum TLS for [FIPS 140-3 validated endpoints](https://docs.aws.amazon.com/general/latest/gr/kms.html). - -When you configure a HTTP client to prefer post-quantum TLS connections with s2n-tls, the post-quantum ciphers are first in the cipher preference list. However, the preference list includes the classic, non-hybrid ciphers lower in the preference order for compatibility. When you configure an HTTP client to prefer post-quantum TLS with an AWS KMS FIPS 140-3 validated endpoint, s2n-tls negotiates a classic, non-hybrid key exchange cipher. - -For a list of AWS KMS endpoints for each AWS Region, see [AWS Key Management Service endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/kms.html) in the _Amazon Web Services General Reference_. For information about FIPS endpoints, see [FIPS endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html#FIPS-endpoints) in the _Amazon Web Services General Reference_. +AWS KMS supports hybrid post-quantum TLS on all endpoints including [FIPS 140-3 validated endpoints](https://docs.aws.amazon.com/general/latest/gr/kms.html).