Skip to main content

AWS Cloud Security

AWS Post-Quantum Confidentiality Readiness

Explore service-wise status and resources for protecting data in transit against harvest now, decrypt later

Shared responsibility for post-quantum confidentiality

Data in transit over an untrusted network can be recorded today and decrypted in the future when a large quantum computer is practical. Post-quantum key exchange in protocols like TLS helps secure data against this risk of harvest now and decrypt later. AWS relies on ML-KEM for post-quantum key exchange. We generally use hybrid PQ key exchange, which combines ML-KEM with a traditional key exchange method. This is the industry norm today, and will evolve toward pure PQ key exchange in the future. 

As with all aspects of PQC upgrades, AWS’s support for PQ key exchange will follow the shared responsibility model. For public AWS service endpoints, which are owned by AWS, we transparently deploy server-side support. The endpoints transparently enforce use of PQ key exchange for any client that advertises support for ML-KEM. Customers are responsible for updating clients that invoke AWS APIs to a version and configuration that supports ML-KEM (learn how to update your clients today). For services that manage customer-owned resources like load balancers on your behalf, customers will generally need to opt-in by updating their resource configuration with a newer quantum-resistant data-in-transit encryption policy. Links to service-wise documentation are provided in the table below.

PQ Key Exchange Support in AWS Service

Service endpoint support is transparent for updated clients. For managed resources, you can opt-in via service console or API call.
    Service Name Status of ML-KEM support for quantum-resistant confidentiality Shared Responsibility: Transparent or Opt-In Observability and Governance Additional Notes and Resources
Amazon API Gateway REST API endpoints can be configured with policies that prefer hybrid PQ key exchange Opt-in: Customers must select an appropriate TLS policy via API or console. Coming soon Read the launch blog to learn about configuring TLS policies with API Gateway 
AWS Application Auto Scaling On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
Amazon Application Recovery Controller (ARC) On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS AppSync On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
Amazon Aurora MySQL Hybrid PQ key exchange available to secure database communications Opt in: Customers must upgrade to at least MySQL version 8.4.8, and update clients as appropriate.  TLS information for connections can be included in database logs. Review the launch announcement and documentation. 
Amazon Aurora PostgreSQL Hybrid PQ key exchange available to secure database communications Opt in: Customers must upgrade to at least PostgreSQL version 18, update SSL groups, and update clients as appropriate.  TLS information for connections can be included in database logs (blog). At present, PostgreSQL logs  TLS version and ciphersuite. Review the launch announcement and documentation.
AWS Auto Scaling On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS B2B Data Interchange On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS Certificate Manager (ACM) Hybrid PQ key exchange launched in FIPS & non-FIPS endpoints, in commercial and US GovCloud regions. Transparent. Customers must update clients. CloudTrail events, through tlsDetails, provide TLS version, cipher suite, and key exchange. This row covers TLS security for data exchanged with public service endpoints. For details on public and private certificate types supported by ACM, refer to ACM documentation. 
AWS Classic Load Balancer (CLB) No PQC plan  Customers should migrate to Elastic Load Balancer (ELB) Not applicable Learn more about migrating your Classic Load Balancer in documentation. 
AWS Clean Rooms

AWS Clean Rooms ML		 On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS Cloud Control API On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
Amazon Cloud Directory On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS Cloud9 On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
Amazon CloudFront Connections between TLS client and CloudFront POP prefer hybrid PQ key exchange. Transparent. No action needed by customers. End users should use updated web browsers or client applications as appropriate.  Coming soon

Read the What's New post announcing automatically enabled support for hybrid PQ key exchange. Explore service documentation.

Note: For client-to-edge connections, PQC support is available on all existing security policies by default, requiring no re-configuration by customers. For connections to origin servers, support is coming soon. 
AWS CloudFormation On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS CloudHSM On the control plane, hybrid PQ key exchange launched in FIPS & non-FIPS endpoints, in commercial and US GovCloud regions. Transparent. Customers must update clients used to make control plane calls. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. 

This row covers TLS security for data exchanged with public service endpoints.

On the data plane, HSM instances are accessed by your clients within your VPC, over a channel that is encrypted end-to-end between your client and your HSM instance (learn more).

For details on algorithms and key types supported within CloudHSM for direct use by your workloads, refer to CloudHSM documentation.
Amazon CloudSearch On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients used to make control plane calls. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS CodeArtifact On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS CodeBuild

 Hybrid PQ key exchange launched in FIPS & non-FIPS endpoints, in commercial and US GovCloud regions. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS CodeCommit
AWS CodeDeploy		 On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS CodeGuru Profiler On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS CodePipeline Hybrid PQ key exchange launched in FIPS & non-FIPS endpoints, in commercial and US GovCloud regions. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
Amazon Cognito TLS policies that prefer hybrid PQ key exchange are available for custom user pool domains  Transparent. Customers may opt-in to stricter policies to disallow fallback to older TLS versions.  In the console or via API, an administrator can validate the TLS configuration applied to the custom domain. Learn more about custom domains in Cognito documentation
Amazon Comprehend On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
AWS Config On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
Amazon Connect Health On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS Database Migration Service (DMS) On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS Deadline Cloud On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS Device Farm On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
AWS Direct Connect Hybrid PQ key exchange launched in API endpoints Transparent. Customers must ensure they configure MAC security using updated clients CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
Amazon DocumentDB On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
Amazon DynamoDB

Hybrid PQ key exchange launched in non-FIPS endpoints, in commercial and US GovCloud regions.

Note: Support in DynamoDB Accelerator, and in FIPS endpoints, is coming soon.

 Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
Amazon EC2 Auto Scaling On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
Amazon EC2 Instance Connect On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
Amazon Elasticache On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
Amazon Elastic Block Store (Amazon EBS) On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
Amazon Elastic Container Registry (ECR) On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
Amazon Elastic File System (EFS) On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
Elastic Load Balancing: Application Load Balancer (ALB) TLS policies that prefer hybrid PQ key exchange are available for customers to apply to listeners. Opt-in: Customers must update listener configuration via API or console.

Connection logs include keyExchange (documentation)

IAM condition keys support allowlist of PQ-ready SSL policies and denylist of legacy SSL policies (learn more).

Read the What's New post announcing support for hybrid PQ-key exchange.

Explore Application Load Balancer (ALB) Documentation.
Elastic Load Balancing: Network Load Balancer (NLB) TLS policies that prefer hybrid PQ key exchange are available for customers to apply to listeners. Opt-in: Customers must update listener configuration via API or console. Access logs include keyExchange (documentation).

Read the What's New post announcing support for hybrid PQ key exchange.

Explore Network Load Balancer (NLB) Documentation.
AWS Elemental MediaConnect On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS Elemental MediaStore On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  Mo additional notes
AWS End User Messaging On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon No additional notes
Amazon EventBridge On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
AWS Firewall Manager Hybrid PQ key exchange launched in FIPS & non-FIPS endpoints, in commercial and US GovCloud regions. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes

Amazon GameLift Server

Amazon GameLift Streams

 On the control plane, hybrid PQ key exchange launched in endpoints in all available regions. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
Amazon Glacier On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additonal notes
AWS Health On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS HealthOmics On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS Identity and Access Management (IAM) Hybrid PQ key exchange launched in FIPS & non-FIPS endpoints, in commercial and US GovCloud regions. Transparent. Customers must update clients.  CloudTrail includes TLS version,  cipher suite, and key exchange. No additional notes
AWS IAM Identity Center Hybrid PQ key exchange launched in FIPS & non-FIPS endpoints, in commercial and US GovCloud regions. Transparent. Customers must update clients CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
AWS IAM Roles Anywhere (IAM RA) Hybrid PQ key exchange launched in FIPS & non-FIPS endpoints, in commercial and US GovCloud regions. Transparent. Customers must update clients CloudTrail includes TLS version, cipher suite, and key exchange.  This row covers TLS security for data exchanged with public service
endpoints. For details on using ML-DSA with IAM RA for quantum-resistant trust policies and certificates, refer to this launch announcement or the IAM RA user guide..
Amazon Interactive Video Service (IVS) On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
AWS Invoicing On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
AWS Key Management Service (KMS) Hybrid PQ key exchange launched in FIPS & non-FIPS endpoints, in commercial and US GovCloud regions Transparent. Customers must update clients. CloudTrail events, through tlsDetails, provide TLS version, cipher suite, and key exchange

Read the Launch blog, including in-depth performance analysis of hybrid PQ key exchange.

Refer to service documentation.

Explore the hands-on Builder Workshop

Note: This row covers TLS security for data exchanged with public service endpoints. For details on algorithms and key types supported within KMS for direct use by your workloads,  including ML-KEM and ML-DSA, refer to KMS documentation. 
Amazon Keyspaces On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
Amazon Kinesis Data Streams On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
Amazon Lightsail On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
Amazon Lookout For Equipment On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
Amazon Machine Learning (ML) On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
Amazon Managed Service for Apache Flink On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS Network Firewall (NFW) Hybrid PQ key exchange launched in FIPS & non-FIPS endpoints, in commercial and US GovCloud regions. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. NFW can handle PQ-TLS handshakes, but you may need to adjust rules that aggressively drop connections. To learn more, see default drop actions, and re:Post forum guidance.  
AWS Parallel Computing Service On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
AWS Payment Cryptography (APC) Hybrid PQ key exchange launched in FIPS & non-FIPS endpoints, in commercial and US GovCloud regions. Transparent. Customers must update clients. CloudTrail events, through tlsDetails, provide TLS version, cipher suite, and key exchange. Read the launch announcement.
Amazon Relational Database Service (RDS) for MariaDB Hybrid PQ key exchange available to secure database communications Opt in: Customers must upgrade database to at least MariaDB version 12.3.3, and update clients as appropriate.  You can query active sessions for the TLS properties, including ssl_named_group, that the current session negotiated.   Review release notes in documentation.
Amazon Relational Database Service (RDS) for MySQL Hybrid PQ key exchange available to secure database communications  Opt in: Customers must upgrade database to at least MySQL version 8.4.11, and update clients as appropriate.  TLS information for connections can be included in database logs. Review release notes in documentation.
Amazon Relational Database Service (RDS) for PostgreSQL Hybrid PQ key exchange available to secure database communications Opt in: Customers must upgrade to at least PostgreSQL version 18, update SSL groups, and update clients as appropriate. TLS information for connections can be included in database logs (blog). At present, PostgreSQL logs  TLS version and ciphersuite. Review the launch announcement and  documentation.
AWS Secrets Manager (ASM) Hybrid PQ key exchange launched in FIPS & non-FIPS endpoints, in commercial and US GovCloud regions Transparent. Customers must update clients. CloudTrail includes TLS version, cipher suite, and key exchange.

Read the Launch blog, including in-depth performance analysis of hybrid PQ key exchange.

Note: As of April 2026, current versions of all caching clients including the Secrets Manager Agent enable and prefer hybrid PQ key exchange by default (learn more). 
AWS Secure Token Service (STS) Hybrid PQ key exchange launched in FIPS & non-FIPS endpoints, in commercial and US GovCloud regions Transparent. Customers must update clients. CloudTrail includes TLS version, cipher suite and key exchange.  No additional notes
AWS Service Quotas On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
Amazon Simple Notification Service (SNS) On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
Amazon Simple Storage Service (S3) Hybrid PQ key exchange launched in FIPS & non-FIPS endpoints, in commercial and US GovCloud regions, for all bucket types. Transparent. Customers must update clients.

Data plane logs include TLS version and ciphersuite, with key exchange coming soon.

IAM condition keys support enforcing use of TLS to access buckets. 

Read the launch announcement.

Explore service documentation.
Amazon Simple Queue Service (SQS) On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
Amazon Simple Workflow Service (SWF) On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
AWS Transfer Family (SFTP domains) SFTP configurations that prefer ML-KEM are available for customers to apply. Opt-in: Customers must update SFTP endpoint configuration. SFTP logs include cipher suite and key exchange.

Read the blog post to understand how AWS Transfer Family supports post-quantum hybrid SFTP file transfers.

Refer to service documentation for in-depth guidance on upgrading your SFTP endpoint and clients that connect to the endpoint. 
Amazon Translate On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
Amazon Verified Permissions On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon. No additional notes
Amazon Workdocs On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes
Amazon Workspaces

Amazon Workspaces Applications		 On the control plane, hybrid PQ key exchange launched in endpoints in commercial and US GovCloud regions with FIPS as applicable. Transparent. Customers must update clients. CloudTrail includes TLS version and cipher suite. Key exchange coming soon.  No additional notes

Learn More about Migrating to PQC

To explore resources on your migration to PQC, visit PQC Migration Strategies or Contact Us.