Implementing customer managed keys for AWS Lambda durable functions with Terraform

This article demonstrates how to implement customer-managed AWS KMS keys for encrypting AWS Lambda durable function execution data in a payment processing workflow using Terraform.

• AWS Lambda durable functions automatically checkpoint execution state to durable storage, requiring encryption controls for regulated workloads
• Customer-managed KMS keys enable key rotation scheduling, decryption access restrictions, and per-function audit trails in CloudTrail
• Reference architecture uses DynamoDB, EventBridge Pipes, Lambda durable functions, and SQS for event-driven payment processing
• Step-by-step deployment guide includes Terraform infrastructure provisioning, KMS key configuration, and Lambda function setup
• Durable execution data remains encrypted throughout function lifetime; key deletion or policy changes only affect new executions
• CloudTrail logs track all KMS operations including dry-run validation calls when configuring customer-managed keys

The solution provides a deployable reference architecture for regulated payment processing workloads requiring full encryption key control and compliance auditability.