- Adds support for customer‑managed KMS keys to encrypt CloudWatch Synthetics canary environment variables at rest
- Allows optional client‑side encryption of individual values with decryption via the KMS Decrypt API
- Enables per‑region key selection for multi‑location canaries, supporting regulatory key‑management requirements