AWS Key Management Service (KMS)
Creating and controlling encryption keys on AWS: customer managed, AWS managed, and AWS owned keys, symmetric and asymmetric keys, envelope encryption and data keys, key policies, IAM, and grants, automatic and on-demand rotation, multi-Region keys, deletion waiting periods, imported key material, CloudHSM and external key stores, quotas, and cost.
6 min read · Last reviewed · SAA-C03
Sign in to bookmark tutorials and track what you have read.
On this page
What it is
AWS Key Management Service (KMS) is a managed service to create and control the keys used to encrypt and sign data. KMS keys are protected by FIPS (Federal Information Processing Standards)US government standards for computer systems. FIPS 140-3, and the earlier FIPS 140-2, set security requirements for cryptographic modules, such as the hardware security modules behind AWS KMS and AWS CloudHSM.Glossary entry Security Level 3 validated HSM (Hardware security module)A tamper-resistant hardware device that creates and stores cryptographic keys and uses them without ever exposing them. AWS KMS uses HSMs internally; AWS CloudHSM gives you dedicated HSMs that you control.Glossary entry (HSMs) and never leave KMS unencrypted. Most AWS services that store data, such as S3, EBS, RDS, DynamoDB, and Lambda, integrate with KMS for Encryption at restEncrypting data where it is stored, such as on disks, in databases, or in backups, so that it cannot be read without the key. On AWS it usually uses keys in AWS KMS.Glossary entry.
Choose KMS when a question asks to encrypt data at rest with keys you control, audit key use (every use is logged in CloudTrail), or separate who can manage keys from who can use them. For how KMS fits with S3 encryption options, TLS (Transport Layer Security)The protocol that encrypts traffic between a client and a server and lets the server prove its identity with a certificate. It replaced SSL, though the older name is still common; HTTPS is HTTP over TLS.Glossary entry, and data retention, see Encryption keys, certificates, and data retention.
Types of keys
| Key type | Who manages it | Notes |
|---|---|---|
| Customer managed keyA KMS key that you create, own, and manage: you control its key policy, rotation, and deletion. AWS managed keys, in contrast, are created and managed for you by an AWS service.Glossary entry | You: key policy, rotation, enable or disable, deletion | Full control and audit; a monthly charge plus usage |
| AWS managed key | AWS, for one service in your account (alias aws/<service>, such as aws/ebs) |
Usable only by that service in your account; you can't change its policy |
| AWS owned key | AWS, shared across accounts | Free and invisible; you can't view, audit, or manage it |
- Symmetric keys (the default) encrypt and decrypt with the same key, and never leave KMS. Asymmetric keys (RSA or ECC) are used for public-key encryption or digital signatures, and the public key can be downloaded.
- Envelope encryptionEncrypting data with a data key, then encrypting that data key with another key, such as a KMS key, and storing the encrypted data key with the data. Large data never has to be sent to AWS KMS, only the small data key.Glossary entry: KMS
Encrypthandles up to 4 KB of data. For larger data, services generate a data key: KMS returns a plaintext data key to encrypt the data and an encrypted copy to store alongside it. To decrypt, KMS decrypts the data key.
Controlling access
- Key policy: every KMS key has exactly one key policy. It is the primary way to control access, and it must allow access, directly or by enabling IAM policies, before anyone can use the key.
- IAM policies can grant access when the key policy allows the account to use IAM.
- Grants: often used for temporary permissions. Services such as EBS use grants to work with your key on your behalf.
- Use encryption context and condition keys (such as
kms:ViaService) to narrow how a key can be used.
Key lifecycle
- Rotation (customer managed symmetric keys):
- Automatic rotation generates new key material every year by default, or on a custom rotation period you set.
- On-demand rotation rotates immediately.
- The key ID stays the same, and old material stays available to decrypt existing data.
- Deletion is destructive: data encrypted with the key can no longer be decrypted. KMS requires a waiting period of 7 to 30 days (default 30). Disable a key first if you're unsure.
- Multi-AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry keys: related keys in different Regions with the same key material and key ID, so data encrypted in one Region can be decrypted in another without a cross-Region call. Useful for global tables, DR (Disaster recovery)Preparing for and recovering from events that take a workload down, such as a Regional outage or deleted data. AWS describes four strategies, from cheapest and slowest to costliest and fastest: backup and restore, pilot light, warm standby, and multi-site active/active.Glossary entry, and replication.
- Imported key material: bring your own key material (BYOK) for a KMS key.
- Custom key stores:
- An AWS CloudHSM key store backs KMS keys with your own CloudHSM cluster.
- An external key store (XKS) keeps keys in a key manager outside AWS that you control, for regulated or sovereignty requirements.
Security, resilience, performance, and cost
Security
- Separate key administrators from key users in the key policy, and audit every API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry call with CloudTrail. Disabling a key immediately stops its use.
Resilience
- KMS is Regional and HA (High availability)The ability of a system to keep serving users when parts of it fail, usually by running redundant copies across Availability Zones and failing over automatically. It is often stated as a percentage of uptime, such as 99.99%.Glossary entry; use multi-Region keys when encrypted data must be decrypted in another Region.
Performance
- KMS has request quotas per account and Region, and requests over the quota are ThrottlingLimiting how many requests a client can make in a period. A throttled request is rejected, often with HTTP status 429 or a throttling error, and should be retried later with backoff.Glossary entry. Services reduce calls with data keys and caching (for example S3 Bucket Keys).
Cost
- Customer managed keys have a monthly charge per key plus a charge per request. There is no charge for creating and storing AWS managed or AWS owned keys.
KMS or another option?
| If the requirement is | Choose |
|---|---|
| Encrypt data in AWS services with keys we control and audit | KMS customer managed key |
| Encryption with no key management at all | AWS owned or AWS managed key (the service default) |
| Single-tenant HSM that we fully control | AWS CloudHSM |
| Keys must stay outside AWS | KMS external key store |
| Decrypt the same data in two Regions | KMS multi-Region keys |
| Store and rotate passwords and API keys | AWS Secrets Manager |
| TLS certificates for websites | AWS Certificate Manager |
Reverse mindmap: when the question points here
- Yes, when the question says
- Encrypt EBS, S3, or RDS data with our own key leads to KMS customer managed key
- Audit every use of the encryption key leads to KMS with CloudTrail
- Separate key admins from key users leads to KMS key policy
- Choose the feature
- Rotate key material yearly leads to Automatic rotation
- Rotate now after an incident leads to On-demand rotation
- Same key in two Regions leads to Multi-Region keys
- Encrypt large files leads to Envelope encryption with data keys
- Sign documents leads to Asymmetric key
- Temporary access for a service leads to Grant
- Bring our own key material leads to Import key material
- Keys in our own HSM cluster leads to CloudHSM key store
- Careful
- Delete a key leads to 7 to 30 day waiting period, disable first
- ThrottlingException leads to Request quotas, use data keys
- No, when the question says
- Rotate database passwords leads to Secrets Manager
Key takeaways
- KMS creates and controls keys in FIPS 140-3 Level 3 HSMs; keys never leave KMS unencrypted.
- Key types: customer managed (full control), AWS managed (per service), and AWS owned (free, invisible).
- Every key has exactly one key policy, which is the primary access control; IAM policies and grants add to it.
- Envelope encryption uses data keys for data larger than 4 KB.
- Rotation is yearly by default (custom periods and on-demand are available); deletion has a 7–30 day waiting period.
- Multi-Region keys, imported key material, CloudHSM key stores, and external key stores cover special needs.
Sources
- AWS KMS Developer Guide: AWS Key Management Service
- AWS KMS Developer Guide: AWS KMS keys
- AWS KMS Developer Guide: Asymmetric keys
- AWS KMS Developer Guide: AWS KMS cryptography essentials
- AWS KMS Developer Guide: Generate data keys
- AWS KMS API Reference: Encrypt
- AWS KMS Developer Guide: Key policies
- AWS KMS Developer Guide: Grants
- AWS KMS Developer Guide: Rotate AWS KMS keys
- AWS KMS Developer Guide: Delete an AWS KMS key
- AWS KMS Developer Guide: Multi-Region keys
- AWS KMS Developer Guide: Importing key material
- AWS KMS Developer Guide: AWS CloudHSM key stores
- AWS KMS Developer Guide: External key stores
- AWS KMS Developer Guide: Request quotas
- AWS KMS pricing