Amazon Cognito now supports customer managed key for encryption at rest

Amazon Cognito now supports customer managed keys in AWS KMS for encrypting user pool data at rest, providing organizations with full control over encryption keys.

• Define organizational policies and revoke access by disabling or deleting keys
• Create and manage customer managed key lifecycle and usage permissions in AWS KMS
• Configure customer managed keys when creating new user pools or update existing ones
• Monitor and audit key usage with AWS CloudTrail for visibility into identity data access
• Available in Essentials and Plus tiers at no additional cost; standard AWS KMS charges apply

Customer managed keys enable organizations to achieve data governance objectives while maintaining full control over encryption and access to user pool data.