- Cognito user pools now support customer‑managed AWS KMS keys for at‑rest encryption
- Configurable during pool creation or update with full lifecycle control and CloudTrail audit logging
- Available in Essentials and Plus tiers at no extra Cognito charge (standard KMS fees apply)