# KMS / ACM / Secrets Manager PQC Checklist (July 2026)

NIST FIPS 203 (ML-KEM), 204 (ML-DSA), 205 (SLH-DSA) — Aug 2024.

## Confirmed AWS support (verify Region/SDK)

- [ ] ML-KEM hybrid TLS to KMS / ACM / Secrets Manager APIs
- [ ] ML-DSA key specs in KMS (`ML_DSA_44` / `65` / `87`)
- [ ] SDK / s2n-tls negotiate hybrid where available

## Migration

- [ ] Inventory keys/certs; tag `data_sensitivity_horizon`
- [ ] Enable hybrid TLS for >5y sensitivity flows
- [ ] Prefer ML-DSA for long-lived signatures (code/doc signing)
- [ ] Expect ACM **public** certs to remain classical until PQ issuance GA
- [ ] Benchmark handshake-heavy short-lived TLS paths

## Counter-case

Hybrid ≠ pure-PQ. Do not require PQ-only on public browsers without classical fallback.