Does anything I paste leave my browser?
No. The parser and the rules load once, then the page makes no network request: no upload, no telemetry, nothing stored. It keeps working offline.
Free tool
EdgePQ Check: post-quantum readiness for your AWS endpoints and keys, from your Terraform.
Paste Terraform, or the JSON from terraform show -json, and EdgePQ Check lists the endpoints and keys still on classical cryptography, says what can be changed today and what cannot, and gives the fix for each.
It runs in your browser. Nothing you paste leaves it: the page makes no network request once the parser has loaded, stores nothing, and asks for no sign-up. Each finding cites the AWS documentation it rests on and the date that page was last read.
Why it matters now
Every TLS connection starts with a key exchange. That is the step to change first.
Traffic recorded today can be decrypted once a large quantum computer exists. Whoever records it does not need to break anything now; they only need to keep it. So the exchange that agrees each session’s keys matters before the signature that proves who is on the other end.
Milestones from the NCSC, Timelines for migration to post-quantum cryptography, published 20 March 2025: complete discovery by 2028, highest-priority migration by 2031, complete migration by 2035.
In words
The front door
A browser, app or partner system opens TLS to your load balancer, CloudFront distribution or API Gateway domain. The policy on that resource decides whether the key exchange can be hybrid post-quantum. EdgePQ Check reads that policy from your Terraform.
Your calls to AWS
Your services open TLS to KMS and Secrets Manager. AWS already offers ML-KEM there; your client decides whether it is used. Only the command-line version, reading CloudTrail, can see which of your clients do.
What is stored
A KMS key that encrypts with RSA protects ciphertexts that may be kept for years. EdgePQ Check names those keys too.
Not checked
The hop from a front door to your own targets, including CloudFront to your origin.
What it looks at
Every check, with its sources
All but one run on what you paste. The last reads CloudTrail to see which of your own clients negotiate ML-KEM, which only the command-line tool, run against an account, can do.
Key exchange first, because traffic recorded today can be decrypted later. Signatures after, because an existing signature is not at risk until the day a large quantum computer exists. Every check names the AWS page it rests on.
What it does not look at
A line saying a setting is already enabled describes that one setting and nothing more. No tool can vouch for an estate, and this one does not try to.
How it works
The same engine as the command-line tool, on what you paste.
Rules are data
Each rule is a file that names the Terraform resources it reads, what counts as enabled, the fix, and the AWS page it rests on with the date that page was last read. The browser and the command line load the same files.
Four outcomes, not two
Failed: the setting can be changed today and has not been. Not configurable: AWS offers no post-quantum option there yet, so there is nothing to raise a change for. Could not check: the value comes from a variable, a module input or an expression the engine could not resolve. Already enabled: that one setting is on.
What the command-line version adds
A read-only scan of an account across every enabled region. A CloudTrail sample that shows which of your own clients negotiate ML-KEM with KMS and Secrets Manager. A probe that reports the key exchange a live endpoint actually selects. Terraform patches as diffs for a person to review, never applied.
EdgePQ on GitHub
Apache-2.0. The command-line tool, the rules and this page’s engine, in one repository.
Questions
What engineers ask before they paste anything.
What does it not look at?
The list under “What it does not look at” on this page, in the words the tool prints at the top of every report. It includes CloudFront to your origin, your application code and its TLS libraries, and anything behind an expression it could not resolve.
Why does a line say could not check?
Because the value is not in what you pasted: it comes from a variable, a module input or an expression only Terraform can resolve. Paste the plan JSON from terraform show -json and most of those become real values.
What about the clients that connect to my endpoints?
The client chooses whether ML-KEM is used, even when the endpoint offers it. Terraform cannot show that. The command-line version reads CloudTrail to see which of your own clients negotiate ML-KEM with KMS and Secrets Manager.
How do I get the command-line version?
It is open source under Apache-2.0 at github.com/infraedgecloud-tools/edgepq, with the install steps in its README; it needs Node 20 or later. It scans a Terraform tree or an AWS account read-only, verifies live endpoints and writes the patches as diffs.
Want this run across the whole estate?
The command-line version scans every account and region read-only, samples CloudTrail to show which of your own clients still negotiate classical key exchange, verifies live endpoints, and writes the Terraform patches. An engineer runs it with you, reviews what it finds, and the fixes arrive as pull requests in your repository.