Learn how AWS Secrets Manager securely stores, retrieves, and rotates application secrets using IAM, KMS, and DevOps integrations.

Como tirar a senha do banco de dentro do código e da máquina, deixá-la cifrada, auditável e rotacionável — e provar que funciona, com uma aplicação real rodando na AWS.

Quando você cria um servidor na nuvem, as primeiras perguntas costumam ser: como eu entro nele? Onde guardo a senha do banco? Como faço a mesma mudança em dez máquinas sem repetir tudo dez vezes?

Explore how AWS security services can help cryptocurrency exchanges and blockchain platforms prevent, detect, and respond to cyberattacks. Learn from major industry incidents involving Binance and other exchanges, and discover practical strategies using GuardDuty, CloudTrail, WAF, KMS, CloudHSM, and Security Hub to protect digital assets and critical infrastructure.

Why your identity layer deserves a multi-Region design, how the architecture works, and the decisions and practices that make it hold up during an incident.

Running a three-node Vault cluster on Kubernetes with the official Helm chart - Raft storage, AWS KMS auto-unseal, TLS, Kubernetes auth and upgrades that never take it offline.

AWS KMS now supports ML-KEM, a NIST post-quantum cryptography standard for secure key encapsulation that protects against future quantum computing threats.

AWS Key Management Service (KMS) now supports Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), a post-quantum cryptography standard under https://csrc.nist.gov/pubs/fips/203/final, which enables two parties to establish a shared secret. NIST designed ML-KEM to replace the classical key-establishment schemes, like DH/ECDH key agreement, and RSA-based key transport, in their strategic cryptographic roadmap (see https://csrc.nist.gov/pubs/ir/8547/ipd). ML-KEM addresses the "harvest now, decrypt later" threat to those classical schemes, where an adversary records the key-establishment exchange today and recovers the shared secret once sufficiently powerful quantum computers become available. KMS supports all three ML-KEM key specs defined in NIST FIPS 203: ML-KEM-512, ML-KEM-768, and ML-KEM-1024. The Encapsulate API uses the public key to produce a random 32-byte shared secret and its ciphertext form. The Decapsulate API recovers the shared secret from ciphertext using the corresponding private key. KMS protects the private key of an ML-KEM key pair in FIPS 140-3 Level 3 validated hardware security modules (HSMs). You can use the GetPublicKey API to export the public key and distribute it to partners, client applications, or external systems for performing the encapsulate operation locally using cryptographic libraries like AWS-LC, OpenSSL, or Bouncy Castle. ML-KEM is available in all AWS Regions where KMS is available, except the the Middle East (UAE), Middle East (Bahrain), and China Regions. For more information, see https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose-key-spec.html in the AWS KMS Developer Guide.

AWS Key Management Service (KMS) now supports Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), a post-quantum cryptography standard under NIST FIPS 203, which enables two parties to establish a shared secret. NIST designed ML-KEM to replace the classical key-establishment schemes, like DH/ECDH key agreement, and RSA-based key transport, in their strategic cryptographic roadmap (see NIST IR 8547). ML-KEM addresses the "harvest now, decrypt later" threat to those classical schemes, where an adversary records the key-establishment exchange today and recovers the shared secret once sufficiently powerful quantum computers become available. KMS supports all three ML-KEM key specs defined in NIST FIPS 203: ML-KEM-512, ML-KEM-768, and ML-KEM-1024. The Encapsulate API uses the public key to produce a random 32-byte shared secret and its ciphertext form. The Decapsulate API recovers the shared secret from ciphertext using the corresponding private key. KMS protects the private key of an ML-KEM key pair in FIPS 140-3 Level 3 validated hardware security modules (HSMs). You can use the GetPublicKey API to export the public key and distribute it to partners, client applications, or external systems for performing the encapsulate operation locally using cryptographic libraries like AWS-LC, OpenSSL, or Bouncy Castle. ML-KEM is available in all AWS Regions where KMS is available, except the the Middle East (UAE), Middle East (Bahrain), and China Regions. For more information, see Key spec reference in the AWS KMS Developer Guide.

Build a reliable RDS backup and recovery workflow using AWS Backup, EventBridge, KMS, and Systems Manager Automation for production-ready disaster recovery.

AWS Key Management Service (KMS) now supports Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), a post-quantum cryptography standard under NIST FIPS 203, which enables two parties to establish a shared secret. NIST designed ML-KEM to replace the classical key-establishment schemes, like DH/ECDH key agreement, and RSA-based key transport, in their strategic cryptographic roadmap (see NIST IR 8547). ML-KEM addresses the "harvest now, decrypt later" threat to those classical schemes, where an adversary records the key-establishment exchange today and recovers the shared secret once sufficiently powerful quantum computers become available. KMS supports all three ML-KEM key specs defined in NIST FIPS 203: ML-KEM-512, ML-KEM-768, and ML-KEM-1024. The Encapsulate API uses the public key to produce a random 32-byte shared secret and its ciphertext form. The Decapsulate API recovers the shared secret from ciphertext using the corresponding private key. KMS protects the private key of an ML-KEM key pair in FIPS 140-3 Level 3 validated hardware security modules (HSMs). You can use the GetPublicKey API to export the public key and distribute it to partners, client applications, or external systems for performing the encapsulate operation locally using cryptographic libraries like AWS-LC, OpenSSL, or Bouncy Castle. ML-KEM is available in all AWS Regions where KMS is available, except the the Middle East (UAE), Middle East (Bahrain), and China Regions. For more information, see Key spec reference in the AWS KMS Developer Guide.

What Happened On October 12, 2026, Amazon OpenSearch Service announced index-level encryption at rest. On domains running OpenSearch 3.3 or later, individual indexes can use separate AWS KMS customer managed…

Build a publishable OpenPGP certificate whose private halves never leave AWS KMS, then decrypt a real report to it in about twenty minutes.