unstale

npm / @aws-sdk/client-kms

@aws-sdk/client-kms

What changed in @aws-sdk/client-kms 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-11-12.

1 breaking9 new APIs and options2 behavior and defaults1 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.12 on npm

@aws-sdk/client-kms 313 changes

Breaking changes 1

  • A default socket timeout is added for each service, which may change how long requests wait for a socket.

    3.1162.0release notes

New APIs and options 9

  • Adds support for ML-KEM keys in AWS KMS, enabling a post-quantum mechanism to establish a shared secret between two parties.

    3.1157.0release notes

  • Adds three condition keys for controlling CreateGrant access.

    3.1051.0release notes

  • Adds a parameter for creating grants for AWS service principals.

    3.1051.0release notes

  • Adds the SourceArn grant constraint.

    3.1051.0release notes

  • Adds an API to retrieve the last successful cryptographic operation performed on a KMS key, including its timestamp, CloudTrail event ID, and operation.

    3.1038.0release notes

  • Decrypt and ReEncrypt can use dry run without ciphertext to validate authorization.

    3.991.0release notes

  • Clients now allow protocol selection by class constructor.

    3.953.0release notes

  • Adds support for on-demand rotation of AWS KMS Multi-Region keys with imported key material.

    3.938.0release notes

  • Adds support for the ECC_NIST_EDWARDS25519 AWS KMS key spec.

    3.927.0release notes

Behavior and default changes 2

  • Adds cross-account VPC endpoint service connectivity support to CustomKeyStore.

    3.921.0release notes

  • Endpoint ruleset parameter casing was updated, which may affect endpoint resolution.

    3.912.0release notes

Fixes and other changes 1

  • Fixes adaptive retry throttling detection, which may affect retry behavior for KMS requests.

    3.1021.0release notes