feat(client-synthetics): CloudWatch Synthetics adds support for customer managed KMS keys for canary environment variables. Customers can now encrypt their canary's Lambda function environment variables at rest using their own AWS KMS key, providing additional control over data protection.

awstools · awstools · commit c7379151145d · 2026-07-09T18:12:28.000Z
diff --git a/clients/client-synthetics/src/commands/CreateCanaryCommand.ts b/clients/client-synthetics/src/commands/CreateCanaryCommand.ts
@@ -114,6 +114,7 @@ export interface CreateCanaryCommandOutput extends CreateCanaryResponse, __Metad
  *         ],
  *         Ipv6AllowedForDualStack: true || false,
  *       },
+ *       KmsKeyArn: "STRING_VALUE",
  *     },
  *   ],
  *   Tags: { // TagMap
@@ -125,6 +126,7 @@ export interface CreateCanaryCommandOutput extends CreateCanaryResponse, __Metad
  *       KmsKeyArn: "STRING_VALUE",
  *     },
  *   },
+ *   KmsKeyArn: "STRING_VALUE",
  * };
  * const command = new CreateCanaryCommand(input);
  * const response = await client.send(command);
@@ -259,6 +261,7 @@ export interface CreateCanaryCommandOutput extends CreateCanaryResponse, __Metad
  * //         KmsKeyArn: "STRING_VALUE",
  * //       },
  * //     },
+ * //     KmsKeyArn: "STRING_VALUE",
  * //     DryRunConfig: { // DryRunConfigOutput
  * //       DryRunId: "STRING_VALUE",
  * //       LastDryRunExecutionStatus: "STRING_VALUE",
diff --git a/clients/client-synthetics/src/commands/DescribeCanariesCommand.ts b/clients/client-synthetics/src/commands/DescribeCanariesCommand.ts
@@ -182,6 +182,7 @@ export interface DescribeCanariesCommandOutput extends DescribeCanariesResponse,
  * //           KmsKeyArn: "STRING_VALUE",
  * //         },
  * //       },
+ * //       KmsKeyArn: "STRING_VALUE",
  * //       DryRunConfig: { // DryRunConfigOutput
  * //         DryRunId: "STRING_VALUE",
  * //         LastDryRunExecutionStatus: "STRING_VALUE",
diff --git a/clients/client-synthetics/src/commands/GetCanaryCommand.ts b/clients/client-synthetics/src/commands/GetCanaryCommand.ts
@@ -171,6 +171,7 @@ export interface GetCanaryCommandOutput extends GetCanaryResponse, __MetadataBea
  * //         KmsKeyArn: "STRING_VALUE",
  * //       },
  * //     },
+ * //     KmsKeyArn: "STRING_VALUE",
  * //     DryRunConfig: { // DryRunConfigOutput
  * //       DryRunId: "STRING_VALUE",
  * //       LastDryRunExecutionStatus: "STRING_VALUE",
diff --git a/clients/client-synthetics/src/commands/UpdateCanaryCommand.ts b/clients/client-synthetics/src/commands/UpdateCanaryCommand.ts
@@ -145,11 +145,13 @@ export interface UpdateCanaryCommandOutput extends UpdateCanaryResponse, __Metad
  *         ],
  *         Ipv6AllowedForDualStack: true || false,
  *       },
+ *       KmsKeyArn: "STRING_VALUE",
  *     },
  *   ],
  *   RemoveReplicaLocations: [ // RemoveReplicaLocations
  *     "STRING_VALUE",
  *   ],
+ *   KmsKeyArn: "STRING_VALUE",
  * };
  * const command = new UpdateCanaryCommand(input);
  * const response = await client.send(command);
diff --git a/clients/client-synthetics/src/models/models_0.ts b/clients/client-synthetics/src/models/models_0.ts
@@ -59,6 +59,14 @@ export interface AddReplicaLocationInput {
    * @public
    */
   VpcConfig?: VpcConfigInput | undefined;
+
+  /**
+   * <p>The Amazon Resource Name (ARN) of the customer-managed AWS Key Management Service (AWS KMS) key used to encrypt the canary replica's
+   *          AWS Lambda function environment variables at rest. If you don't specify a value,
+   *          the service uses an AWS-managed key.</p>
+   * @public
+   */
+  KmsKeyArn?: string | undefined;
 }
 
 /**
@@ -730,6 +738,14 @@ export interface Canary {
    */
   ArtifactConfig?: ArtifactConfigOutput | undefined;
 
+  /**
+   * <p>The Amazon Resource Name (ARN) of the customer-managed AWS Key Management Service (AWS KMS) key used to encrypt the canary's
+   *          AWS Lambda function environment variables at rest. If you don't specify a value,
+   *          the service uses an AWS-managed key.</p>
+   * @public
+   */
+  KmsKeyArn?: string | undefined;
+
   /**
    * <p>Returns the dry run configurations for a canary.</p>
    * @public
@@ -1290,6 +1306,14 @@ export interface CreateCanaryRequest {
    * @public
    */
   ArtifactConfig?: ArtifactConfigInput | undefined;
+
+  /**
+   * <p>The Amazon Resource Name (ARN) of the customer-managed AWS Key Management Service (AWS KMS) key used to encrypt the canary's
+   *          AWS Lambda function environment variables at rest. If you don't specify a value,
+   *          the service uses an AWS-managed key.</p>
+   * @public
+   */
+  KmsKeyArn?: string | undefined;
 }
 
 /**
@@ -2439,6 +2463,16 @@ export interface UpdateCanaryRequest {
    * @public
    */
   RemoveReplicaLocations?: string[] | undefined;
+
+  /**
+   * <p>The Amazon Resource Name (ARN) of the customer-managed AWS Key Management Service (AWS KMS) key used to encrypt the canary's
+   *          AWS Lambda function environment variables at rest. If you don't specify a value,
+   *          the service uses an AWS-managed key. If you omit this parameter, the service retains
+   *          the existing value. To revert to the AWS-managed key, set this parameter to
+   *          an empty string.</p>
+   * @public
+   */
+  KmsKeyArn?: string | undefined;
 }
 
 /**
diff --git a/clients/client-synthetics/src/schemas/schemas_0.ts b/clients/client-synthetics/src/schemas/schemas_0.ts
@@ -332,8 +332,8 @@ export const errorTypeRegistries = [
 ]
 export var AddReplicaLocationInput$: StaticStructureSchema = [3, n0, _ARLI,
   0,
-  [_L, _VC],
-  [0, () => VpcConfigInput$], 1
+  [_L, _VC, _KKA],
+  [0, () => VpcConfigInput$, 0], 1
 ];
 export var ArtifactConfigInput$: StaticStructureSchema = [3, n0, _ACI,
   0,
@@ -367,8 +367,8 @@ export var BrowserConfig$: StaticStructureSchema = [3, n0, _BC,
 ];
 export var Canary$: StaticStructureSchema = [3, n0, _C,
   0,
-  [_I, _N, _Co, _ERA, _S, _RC, _SRPID, _FRPID, _St, _T, _ASL, _EA, _RV, _VC, _VR, _PRC, _BCr, _EC, _VRi, _MLC, _Ta, _AC, _DRC],
-  [0, 0, () => CanaryCodeOutput$, 0, () => CanaryScheduleOutput$, () => CanaryRunConfigOutput$, 1, 1, () => CanaryStatus$, () => CanaryTimeline$, 0, 0, 0, () => VpcConfigOutput$, () => VisualReferenceOutput$, 0, () => BrowserConfigs, () => EngineConfigs, () => VisualReferencesOutput, () => MultiLocationConfig$, 128 | 0, () => ArtifactConfigOutput$, () => DryRunConfigOutput$]
+  [_I, _N, _Co, _ERA, _S, _RC, _SRPID, _FRPID, _St, _T, _ASL, _EA, _RV, _VC, _VR, _PRC, _BCr, _EC, _VRi, _MLC, _Ta, _AC, _KKA, _DRC],
+  [0, 0, () => CanaryCodeOutput$, 0, () => CanaryScheduleOutput$, () => CanaryRunConfigOutput$, 1, 1, () => CanaryStatus$, () => CanaryTimeline$, 0, 0, 0, () => VpcConfigOutput$, () => VisualReferenceOutput$, 0, () => BrowserConfigs, () => EngineConfigs, () => VisualReferencesOutput, () => MultiLocationConfig$, 128 | 0, () => ArtifactConfigOutput$, 0, () => DryRunConfigOutput$]
 ];
 export var CanaryCodeInput$: StaticStructureSchema = [3, n0, _CCI,
   0,
@@ -437,8 +437,8 @@ export var CanaryTimeline$: StaticStructureSchema = [3, n0, _CT,
 ];
 export var CreateCanaryRequest$: StaticStructureSchema = [3, n0, _CCR,
   0,
-  [_N, _Co, _ASL, _ERA, _S, _RV, _RC, _SRPID, _FRPID, _VC, _RTRT, _PRC, _BCr, _ARL, _Ta, _AC],
-  [0, () => CanaryCodeInput$, 0, 0, () => CanaryScheduleInput$, 0, () => CanaryRunConfigInput$, 1, 1, () => VpcConfigInput$, 64 | 0, 0, () => BrowserConfigs, () => AddReplicaLocations, 128 | 0, () => ArtifactConfigInput$], 6
+  [_N, _Co, _ASL, _ERA, _S, _RV, _RC, _SRPID, _FRPID, _VC, _RTRT, _PRC, _BCr, _ARL, _Ta, _AC, _KKA],
+  [0, () => CanaryCodeInput$, 0, 0, () => CanaryScheduleInput$, 0, () => CanaryRunConfigInput$, 1, 1, () => VpcConfigInput$, 64 | 0, 0, () => BrowserConfigs, () => AddReplicaLocations, 128 | 0, () => ArtifactConfigInput$, 0], 6
 ];
 export var CreateCanaryResponse$: StaticStructureSchema = [3, n0, _CCRr,
   0,
@@ -697,8 +697,8 @@ export var UntagResourceResponse$: StaticStructureSchema = [3, n0, _URRn,
 ];
 export var UpdateCanaryRequest$: StaticStructureSchema = [3, n0, _UCR,
   0,
-  [_N, _Co, _ERA, _RV, _S, _RC, _SRPID, _FRPID, _VC, _VR, _ASL, _AC, _PRC, _DRI, _VRi, _BCr, _ARL, _RRL],
-  [[0, 1], () => CanaryCodeInput$, 0, 0, () => CanaryScheduleInput$, () => CanaryRunConfigInput$, 1, 1, () => VpcConfigInput$, () => VisualReferenceInput$, 0, () => ArtifactConfigInput$, 0, 0, () => VisualReferences, () => BrowserConfigs, () => AddReplicaLocations, 64 | 0], 1
+  [_N, _Co, _ERA, _RV, _S, _RC, _SRPID, _FRPID, _VC, _VR, _ASL, _AC, _PRC, _DRI, _VRi, _BCr, _ARL, _RRL, _KKA],
+  [[0, 1], () => CanaryCodeInput$, 0, 0, () => CanaryScheduleInput$, () => CanaryRunConfigInput$, 1, 1, () => VpcConfigInput$, () => VisualReferenceInput$, 0, () => ArtifactConfigInput$, 0, 0, () => VisualReferences, () => BrowserConfigs, () => AddReplicaLocations, 64 | 0, 0], 1
 ];
 export var UpdateCanaryResponse$: StaticStructureSchema = [3, n0, _UCRp,
   0,
diff --git a/codegen/sdk-codegen/aws-models/synthetics.json b/codegen/sdk-codegen/aws-models/synthetics.json
@@ -57,6 +57,12 @@
           "traits": {
             "smithy.api#documentation": "<p>The VPC configuration to use for the canary replica in this location. If not specified, the replica runs without VPC connectivity.</p>"
           }
+        },
+        "KmsKeyArn": {
+          "target": "com.amazonaws.synthetics#KmsKeyArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the customer-managed AWS Key Management Service (AWS KMS) key used to encrypt the canary replica's\n         AWS Lambda function environment variables at rest. If you don't specify a value,\n         the service uses an AWS-managed key.</p>"
+          }
         }
       },
       "traits": {
@@ -437,6 +443,12 @@
             "smithy.api#documentation": "<p>A structure that contains the configuration for canary artifacts, including \n         the encryption-at-rest settings for artifacts that the canary uploads to Amazon S3.</p>"
           }
         },
+        "KmsKeyArn": {
+          "target": "com.amazonaws.synthetics#KmsKeyArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the customer-managed AWS Key Management Service (AWS KMS) key used to encrypt the canary's\n         AWS Lambda function environment variables at rest. If you don't specify a value,\n         the service uses an AWS-managed key.</p>"
+          }
+        },
         "DryRunConfig": {
           "target": "com.amazonaws.synthetics#DryRunConfigOutput",
           "traits": {
@@ -1253,6 +1265,12 @@
           "traits": {
             "smithy.api#documentation": "<p>A structure that contains the configuration for canary artifacts, including \n         the encryption-at-rest settings for artifacts that the canary uploads to Amazon S3.</p>"
           }
+        },
+        "KmsKeyArn": {
+          "target": "com.amazonaws.synthetics#KmsKeyArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the customer-managed AWS Key Management Service (AWS KMS) key used to encrypt the canary's\n         AWS Lambda function environment variables at rest. If you don't specify a value,\n         the service uses an AWS-managed key.</p>"
+          }
         }
       },
       "traits": {
@@ -4894,6 +4912,12 @@
           "traits": {
             "smithy.api#documentation": "<p>A list of locations (Amazon Web Services Regions) to remove as replicas for the canary. You must specify at least one location to remove. All replicas can be removed in a single API      \n call and you cannot remove the primary location.</p>"
           }
+        },
+        "KmsKeyArn": {
+          "target": "com.amazonaws.synthetics#KmsKeyArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the customer-managed AWS Key Management Service (AWS KMS) key used to encrypt the canary's\n         AWS Lambda function environment variables at rest. If you don't specify a value,\n         the service uses an AWS-managed key. If you omit this parameter, the service retains\n         the existing value. To revert to the AWS-managed key, set this parameter to\n         an empty string.</p>"
+          }
         }
       },
       "traits": {
