developersIO
I tried the new Lambda Durable Functions feature "Encryption of Durable Execution Data"

I tried the new Lambda Durable Functions feature "Encryption of Durable Execution Data"

AWS Lambda Durable Functions now supports encrypting durable execution data with customer-managed keys (CMK). We tested how to configure CMKs, error behavior when a key is disabled, access control using IncludeExecutionData, and auditing with CloudTrail.
Lambda durable functionsAWS Key Management Service（KMS）セキュリティAWS Lambda
2026.07.23

This page has been translated by machine translation. View original

Introduction

On July 22, 2026, AWS Lambda Durable Functions became able to encrypt durable execution data with Customer Managed Keys (CMK).

https://aws.amazon.com/about-aws/whats-new/2026/07/durablefunctions-cmk/

For an overview of Lambda Durable Functions, please refer to the following article.

https://dev.classmethod.jp/articles/aws-lambda-durable-functions-awsreinvent/

Below is a summary of the changes introduced by this update.

Item Previous (AWS Owned Key) New Feature (CMK)
Encryption method Automatically encrypted with AWS owned key Customer managed key can be specified
Key management Fully managed by AWS User controls key policy, rotation, and disabling
Data retrieval control Always returns all data (no control) Control input/output data retrieval with IncludeExecutionData parameter
When key is disabled Not applicable (AWS managed) All data inaccessible (including metadata, as of this verification)
CloudTrail audit No KMS events GenerateDataKey / Decrypt events recorded
Additional cost None CMK storage $1/month + API charges (free up to 20,000 requests/month)

The following sections verify the process from configuration to auditing in order.

Verification Details

Verification Environment

Item Value
Region ap-northeast-1 (Tokyo)
Lambda runtime nodejs24.x
Function name durable-cmk-test
CMK alias/durable-cmk-test (symmetric encryption, single region)
Execution role durable-cmk-test-role
Verification date 2026-07-23

CMK Creation and Key Policy

A symmetric encryption key was created for encrypting durable execution data.

aws kms create-key \
  --description "Durable Functions CMK test" \
  --key-usage ENCRYPT_DECRYPT \
  --key-spec SYMMETRIC_DEFAULT

aws kms create-alias \
  --alias-name alias/durable-cmk-test \
  --target-key-id EXAMPLE-KEY-ID

The key policy grants permissions to the following 4 principals.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "EnableRootAccountAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "AllowLambdaServicePrincipal",
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": [
        "kms:GenerateDataKey",
        "kms:Decrypt",
        "kms:DescribeKey"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "123456789012"
        }
      }
    },
    {
      "Sid": "AllowExecutionRoleDecrypt",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/durable-cmk-test-role"
      },
      "Action": "kms:Decrypt",
      "Resource": "*"
    },
    {
      "Sid": "AllowCallerDecrypt",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:user/durable-cmk-test-user"
      },
      "Action": "kms:Decrypt",
      "Resource": "*"
    }
  ]
}

The role of each statement is as follows.

  • EnableRootAccountAccess — Grants the root account (including permission delegation via IAM policies within the account) full key operations. This is a common configuration to prevent the key from being locked out.
  • AllowLambdaServicePrincipal — Grants the Lambda service principal GenerateDataKey, Decrypt, and DescribeKey. The aws:SourceAccount condition limits requests to those from the same account.
  • AllowExecutionRoleDecrypt — Grants Decrypt to the Lambda function's execution role. This is required to decrypt the data key during replay or checkpoint reads.
  • AllowCallerDecrypt — Grants Decrypt to the caller of the GetDurableExecution API. This is required when retrieving execution data with IncludeExecutionData enabled.

Configuring DurableConfig.KMSKeyArn

Following the official documentation, the CMK was configured on an existing Durable Function using update-function-configuration. Since --durable-config replaces the entire DurableConfig object, the existing ExecutionTimeout and RetentionPeriodInDays must also be specified.

aws lambda update-function-configuration \
  --function-name durable-cmk-test \
  --durable-config '{
    "KMSKeyArn":"arn:aws:kms:ap-northeast-1:123456789012:key/EXAMPLE-KEY-ID",
    "ExecutionTimeout":3600,
    "RetentionPeriodInDays":7
  }'

After configuration, you can confirm that KMSKeyArn has been added to DurableConfig in the output.

Output of update-function-configuration
{
  "FunctionName": "durable-cmk-test",
  "State": "Active",
  "LastUpdateStatus": "Successful",
  "DurableConfig": {
    "KMSKeyArn": "arn:aws:kms:ap-northeast-1:123456789012:key/EXAMPLE-KEY-ID",
    "RetentionPeriodInDays": 7,
    "ExecutionTimeout": 3600
  }
}

Verifying Durable Execution Behavior with CMK

After configuring the CMK, a version was published and a durable execution was started with an asynchronous invocation.

aws lambda publish-version --function-name durable-cmk-test

aws lambda invoke \
  --function-name durable-cmk-test:2 \
  --invocation-type Event \
  --cli-binary-format raw-in-base64-out \
  --payload '{"orderId":"order-12345"}' \
  response.json

After the durable execution completes, retrieve the durable execution ARN using list-durable-executions-by-function.

aws lambda list-durable-executions-by-function \
  --function-name durable-cmk-test:2 \
  --statuses SUCCEEDED

The result was confirmed using get-durable-execution with the retrieved ARN.

DURABLE_EXECUTION_ARN="arn:aws:lambda:ap-northeast-1:123456789012:function:durable-cmk-test:2/durable-execution/EXAMPLE-EXECUTION-NAME/EXAMPLE-EXECUTION-ID"

aws lambda get-durable-execution \
  --durable-execution-arn "$DURABLE_EXECUTION_ARN" \
  --include-execution-data

A durable execution containing 3 steps and a 10-second wait completed successfully, and it was confirmed that DurableConfig.KMSKeyArn was included in the result.

Output of get-durable-execution
{
  "DurableExecutionArn": "arn:aws:lambda:ap-northeast-1:123456789012:function:durable-cmk-test:2/durable-execution/EXAMPLE-EXECUTION-NAME/EXAMPLE-EXECUTION-ID",
  "InputPayload": "{\"orderId\":\"order-12345\"}",
  "Result": "{\"orderId\":\"order-12345\",\"status\":\"completed\",\"steps\":[...]}",
  "Status": "SUCCEEDED",
  "StartTimestamp": "2026-07-23T10:13:58.463000+09:00",
  "EndTimestamp": "2026-07-23T10:14:10.524000+09:00",
  "Version": "2",
  "ExecutionDataIncluded": true,
  "DurableConfig": {
    "KMSKeyArn": "arn:aws:kms:ap-northeast-1:123456789012:key/EXAMPLE-KEY-ID",
    "RetentionPeriodInDays": 7,
    "ExecutionTimeout": 3600
  }
}

Verifying Error Behavior When Key Is Disabled

The behavior when accessing durable execution data after disabling the CMK was verified.

aws kms disable-key --key-id EXAMPLE-KEY-ID

When get-durable-execution was executed after disabling the key, an error was returned immediately.

An error occurred (KMSDisabledException) when calling the GetDurableExecution operation:
Lambda was unable to access your execution data because the KMS key used is disabled.
Check the KMS key configured in the function's durable config.
KMS Exception: DisabledException
KMS Message: arn:aws:kms:ap-northeast-1:123456789012:key/EXAMPLE-KEY-ID is disabled.

When attempting to retrieve only metadata by specifying --no-include-execution-data, the same KMSDisabledException occurred. While the documentation states that KMS is not called when IncludeExecutionData=false, the API itself returned an error as of this verification (the service behavior may change in the future). In this verification, durable execution data that had completed normally before the key was disabled also resulted in KMSDisabledException after disabling, making it inaccessible.

Comparison of IncludeExecutionData

After re-enabling the key, the difference in returned fields between --include-execution-data and --no-include-execution-data was verified.

In get-durable-execution, the returned content varies as follows depending on the specified value.

Parameter Returned Content
--include-execution-data InputPayload, Result, ExecutionDataIncluded=true, all metadata
--no-include-execution-data Metadata only (Status, timestamps, Version, DurableConfig). No InputPayload/Result. ExecutionDataIncluded=false
Not specified (CLI default) Same behavior as --include-execution-data (CLI default is true)

The same was verified with get-durable-execution-history.

Parameter Payload Field
--include-execution-data Each event's Payload contains plaintext JSON + "Truncated": false
--no-include-execution-data Payload hidden, only "Truncated": true

When --no-include-execution-data was specified, no Decrypt event for the caller role was recorded in CloudTrail (see the table in the next section for details).

Verifying KMS Events in CloudTrail

In durable executions using CMK, the following KMS events are recorded in CloudTrail. The patterns observed in this verification are shown below (due to data key caching, these may not occur with every durable execution).

Event Caller Timing
GenerateDataKey AWSService (lambda.amazonaws.com) At durable execution start (data key generation)
Decrypt AWSService (lambda.amazonaws.com) During durable execution processing (data key decryption)
Decrypt Execution role During replay/checkpoint reads
Decrypt Caller role During GetDurableExecution (IncludeExecutionData=true)
Decrypt (DisabledException) Caller role During GetDurableExecution after key is disabled

The GenerateDataKey and Decrypt events for durable execution data include the following encryptionContext (not included in the DescribeKey event at key configuration time).

{
  "aws:lambda:FunctionArn": "arn:aws:lambda:ap-northeast-1:123456789012:function:durable-cmk-test"
}

The Decrypt event for the execution role includes an inScopeOf field, and the source function that issued the credentials is recorded with a versioned ARN. This allows tracking of which version of the function the Decrypt request originated from.

Cost

The costs when using CMK are as follows.

Item Price
CMK storage $1/month/key (prorated by hour, approximately $0.00137/hour)
KMS API requests Free up to 20,000 per month, $0.03/10,000 requests for excess
Durable Functions CMK feature No additional charge
Actual cost of this verification Less than $0.01 (approximately 10 API requests total)

Keys in pending deletion state (PendingDeletion) do not incur storage charges. For pricing details, refer to the AWS KMS pricing page.

Summary

Lambda Durable Functions can now use Customer Managed Keys (CMK) to encrypt durable execution data.

By using CMK, key management, access control, and auditing of KMS operations via CloudTrail can be performed according to your organization's requirements. This is useful when handling sensitive execution data or when there are requirements for encryption key management and auditing.

On the other hand, disabling a key or changing key policies affects durable execution processing and data retrieval. In this verification, a discrepancy was also observed between the documentation and the actual behavior of IncludeExecutionData=false when the key was disabled.

Please carefully consider adoption based on your requirements, taking into account the controllability of CMK and the impact that key management has on the availability of durable execution data.

Share this article