Aurora PostgreSQL adds post-quantum TLS key exchange

Amazon Web Services announced support for post-quantum TLS key exchange in Amazon Aurora PostgreSQL-Compatible Edition on October 29, 2026. According to the AWS release notice, support became available that day, providing a post-quantum cryptography option for protecting database traffic in transit.

What can be configured

AWS specifically identifies Aurora PostgreSQL versions 18 and higher as supporting modification of the ssl_groups parameter. Administrators can select cryptographic groups from Aurora PostgreSQL’s allow list to align connections with their organization’s security standards. That version statement concerns parameter configuration; the notice does not provide a complete engine-version support matrix for post-quantum TLS.

The announcement also does not enumerate the allowed groups, describe the default configuration or specify regional coverage. It is therefore not enough to determine which groups to configure or what an existing application connection will use.

Before a rollout

Treat the announcement as a starting point for validation, not a deployment recipe. Before changing a production configuration:

• Confirm support for the target engine release and Region, along with permitted groups, defaults and parameter-change requirements, in the applicable AWS documentation.
• Test representative application drivers, TLS libraries and any connection intermediaries against the intended policy. Verify the key-exchange group actually used by each connection.
• Check how clients behave when they cannot meet that policy, and measure connection-establishment latency under realistic connection churn.

These are recommended validation steps, not compatibility or performance results reported by AWS.

Keep the security claim narrow: AWS announced TLS key exchange for data in transit. The notice should not be treated as evidence of post-quantum protection for stored data or certificate signatures. For database teams evaluating the feature, the priority is to establish a supported configuration and verify connection behavior before rollout.