# What changed in @aws-sdk/client-kms

> 13 changes in @aws-sdk/client-kms 3 from its official release notes, upgrade guides and advisories: 1 breaking, 9 new APIs and options. Each one cited. Sources checked 2026-11-12. HTML: https://unstale.sh/npm/@aws-sdk/client-kms/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @aws-sdk/client-kms 3

### Breaking changes

- A default socket timeout is added for each service, which may change how long requests wait for a socket. (3.1162.0) — [release notes](https://github.com/aws/aws-sdk-js-v3/blob/5b4a724f2ac4006ea5a98c2fed6c629f6845b9bd/clients/client-kms/CHANGELOG.md#311620-2026-11-04)

### New APIs and options

- Adds support for ML-KEM keys in AWS KMS, enabling a post-quantum mechanism to establish a shared secret between two parties. (3.1157.0) — [release notes](https://github.com/aws/aws-sdk-js-v3/blob/5b4a724f2ac4006ea5a98c2fed6c629f6845b9bd/clients/client-kms/CHANGELOG.md#311570-2026-10-26)
- Adds three condition keys for controlling CreateGrant access. (3.1051.0) — [release notes](https://github.com/aws/aws-sdk-js-v3/blob/3ce8aa778c22193dad5f7fcefe239e3a74a3cd4f/clients/client-kms/CHANGELOG.md#310510-2026-05-20)
- Adds a parameter for creating grants for AWS service principals. (3.1051.0) — [release notes](https://github.com/aws/aws-sdk-js-v3/blob/3ce8aa778c22193dad5f7fcefe239e3a74a3cd4f/clients/client-kms/CHANGELOG.md#310510-2026-05-20)
- Adds the SourceArn grant constraint. (3.1051.0) — [release notes](https://github.com/aws/aws-sdk-js-v3/blob/3ce8aa778c22193dad5f7fcefe239e3a74a3cd4f/clients/client-kms/CHANGELOG.md#310510-2026-05-20)
- Adds an API to retrieve the last successful cryptographic operation performed on a KMS key, including its timestamp, CloudTrail event ID, and operation. (3.1038.0) — [release notes](https://github.com/aws/aws-sdk-js-v3/blob/3ce8aa778c22193dad5f7fcefe239e3a74a3cd4f/clients/client-kms/CHANGELOG.md#310380-2026-04-27)
- Decrypt and ReEncrypt can use dry run without ciphertext to validate authorization. (3.991.0) — [release notes](https://github.com/aws/aws-sdk-js-v3/blob/3ce8aa778c22193dad5f7fcefe239e3a74a3cd4f/clients/client-kms/CHANGELOG.md#39910-2026-02-16)
- Clients now allow protocol selection by class constructor. (3.953.0) — [release notes](https://github.com/aws/aws-sdk-js-v3/blob/3ce8aa778c22193dad5f7fcefe239e3a74a3cd4f/clients/client-kms/CHANGELOG.md#39530-2025-12-16)
- Adds support for on-demand rotation of AWS KMS Multi-Region keys with imported key material. (3.938.0) — [release notes](https://github.com/aws/aws-sdk-js-v3/blob/3ce8aa778c22193dad5f7fcefe239e3a74a3cd4f/clients/client-kms/CHANGELOG.md#39380-2025-11-21)
- Adds support for the ECC_NIST_EDWARDS25519 AWS KMS key spec. (3.927.0) — [release notes](https://github.com/aws/aws-sdk-js-v3/blob/3ce8aa778c22193dad5f7fcefe239e3a74a3cd4f/clients/client-kms/CHANGELOG.md#39270-2025-11-07)

### Behavior and default changes

- Adds cross-account VPC endpoint service connectivity support to CustomKeyStore. (3.921.0) — [release notes](https://github.com/aws/aws-sdk-js-v3/blob/3ce8aa778c22193dad5f7fcefe239e3a74a3cd4f/clients/client-kms/CHANGELOG.md#39210-2025-10-30)
- Endpoint ruleset parameter casing was updated, which may affect endpoint resolution. (3.912.0) — [release notes](https://github.com/aws/aws-sdk-js-v3/blob/3ce8aa778c22193dad5f7fcefe239e3a74a3cd4f/clients/client-kms/CHANGELOG.md#39120-2025-10-16)

### Fixes and other changes

- Fixes adaptive retry throttling detection, which may affect retry behavior for KMS requests. (3.1021.0) — [release notes](https://github.com/aws/aws-sdk-js-v3/blob/3ce8aa778c22193dad5f7fcefe239e3a74a3cd4f/clients/client-kms/CHANGELOG.md#310210-2026-03-31)