🧰 AWS Key Management Service

The items that name it 5

• Quantum-resistant signing on AWS, Part 2: Enforce your ML-DSA algorithm policy with SCPs and IAM
  articleas affected products2026-10-12It is written here as AWS Key Management Service (AWS KMS): ML-DSA key specs ML_DSA_44, ML_DSA_65, ML_DSA_87 (ML-DSA-44 is the variant excluded by the example policy; the page states it is a valid, not weak, choice).

  AWS KMS

• Quantum-resistant signing on AWS, Part 1: Build a software supply chain with ML-DSA
  articleas tools2026-10-12It is written here as AWS Key Management Service (AWS KMS): ML-DSA signing keys in FIPS 140-3 Security Level 3 HSMs; 4,096-byte message limit for RAW; supports EXTERNAL_MU; ML-DSA supported in commercial AWS Regions.

  AWS KMS

• Architecting a secure landing zone in the AWS European Sovereign Cloud
  articleas tools2026-09-16It is written here as AWS Key Management Service (AWS KMS).

  Encryption key management, including customer managed keys and External Key Store (XKS)

• Architecting resilient authentication with Amazon Cognito multi-Region replication
  articleas tools2026-09-15It is written here as AWS Key Management Service (AWS KMS).

  Provides symmetric multi-Region customer managed key required to encrypt Cognito user pool data before enabling MRR

• A few notes on AWS Nitro Enclaves: KMS integration
  writeupas affected products2026-08-05It is written here as AWS Key Management Service (KMS).

  Provides key management (CMKs, data keys, data key pairs) integrated with Nitro Enclaves; subject to passive/active attacks and policy misconfiguration discussed in post