RDS PostgreSQL 18 adds post-quantum TLS key exchange
AWS puts hybrid ML-KEM on a customer-provisioned database (not a service endpoint) which means the defense supply chain can configure it directly rather than wait for transparent rollout.
TL;DR
Amazon RDS for PostgreSQL versions 18 and higher now support modifying the ssl_groups parameter to select post-quantum TLS cryptographic groups, including hybrid ML-KEM key exchange. This is the first PQ deployment on a database instance customers provision and configure themselves, as opposed to the transparent server-side rollouts AWS has done on KMS, ACM, and Secrets Manager endpoints. Defense contractors running RDS PostgreSQL 18 can align with NIST's PQC transition by updating a parameter in the console or CLI, no stack migration required.
The announcement extends AWS's post-quantum TLS footprint beyond the transparent endpoint upgrades it's been rolling out since early 2025. AWS KMS, ACM, and Secrets Manager endpoints already negotiate hybrid ML-KEM when clients advertise support for it. CloudFront, ALB, and NLB have since followed. But those are AWS-managed surfaces, the customer's only job was updating their SDK or TLS client. RDS PostgreSQL 18 is different: the customer owns the database instance, configures the ssl_groups parameter, and decides which cryptographic groups to allow.
That distinction matters for the defense supply chain. DoD's PQC transition plan calls for initial deployments by 2027, and both CMMC Level 2 and FedRAMP draw on NIST SP 800-171, with post-quantum cryptography increasingly referenced as a future state. A contractor running RDS PostgreSQL 18 can point to a configured PQ-TLS parameter as a concrete step, rather than waiting for transparent upgrades to reach every service endpoint they use.
What the engineer does Monday
The feature surfaces through the ssl_groups parameter, which works alongside the earlier ssl_ciphers parameter, itself only configurable since RDS PostgreSQL 16.1. The ssl_groups allow list includes hybrid ML-KEM groups. Clients connecting over TLS must advertise ML-KEM support for the negotiation to select a post-quantum group; RDS won't force it on clients that don't offer it. That covers psql connections, JDBC drivers, and application connection pools, each needs a client-side update to realize the protection.
For teams whose PostgreSQL version is below 18, this is a non-event until they upgrade. For everyone else, it's a parameter change in the RDS console or a single CLI call. The operational lift is about as low as these things get.
Published ·Deep Fathom