Achieve full control over your data encryption using customer managed keys in Amazon Managed Service for Apache Flink

The article discusses the new feature in Amazon Managed Service for Apache Flink that allows customers to use customer-managed keys (CMKs) for encrypting application data, providing enhanced control over data encryption.

• Enables full control over encryption keys stored in AWS Key Management Service (AWS KMS)
• Supports encryption of data at rest, including application storage and running application state
• Follows the principle of least privilege with carefully designed permission mechanisms
• Supports key rotation and switching between AWS owned and customer-managed keys
• Requires Flink runtime version 1.20 or later

Key considerations include managing complex IAM roles and policies, understanding the sequence of operations for enabling CMKs, and being aware of restart requirements when changing encryption keys.