AWS KMS Essentialsince 2014
A managed encryption key service for securely creating and managing keys used to encrypt data
What It Does
AWS KMS (Key Management Service) is a fully managed service for securely creating, storing, and managing encryption keys used to protect data. It integrates with many AWS services including S3, EBS, RDS, and DynamoDB, enabling data encryption with just a few clicks. It centrally manages the key lifecycle - creation, rotation, disabling, and deletion - and provides fine-grained access control through IAM policies and key policies. Keys are protected by FIPS 140-3 validated hardware security modules (HSMs).
Use Cases
Used for encrypting data at rest in S3 buckets and EBS volumes, database encryption for RDS and DynamoDB, client-side encryption of application data, generating and verifying digital signatures, and encrypting secrets stored in Secrets Manager and Parameter Store - essentially any scenario requiring data protection.
Everyday Analogy
Think of it like a key management office in an apartment building. The management office (KMS) centrally manages the keys (encryption keys) for each room (data), and only authorized residents (IAM users) can use their own room's key. Keys are periodically replaced (rotated) to minimize the risk of loss or theft. The keys themselves are stored in a safe (HSM) and cannot be taken outside.
What Is KMS?
AWS Key Management Service (KMS) is a fully managed service for managing the lifecycle of encryption keys. While encryption is fundamental to data protection, securely managing encryption keys is complex and requires specialized knowledge. KMS abstracts this complexity, making it easy to create and manage encryption keys through API calls or console operations. Keys are protected by FIPS 140-3 Level 3 validated HSMs, and no one - including AWS employees - can access the plaintext keys.
Types of Encryption Keys
KMS primarily handles two types of keys. KMS keys (formerly called CMKs) are encryption keys managed within KMS, used for generating data keys and for direct encryption/decryption. Data keys are keys encrypted by KMS keys, used for encrypting large volumes of data. This mechanism is called envelope encryption and is more efficient than encrypting data directly with KMS keys. KMS keys come in symmetric (AES-256) and asymmetric (RSA, ECC) varieties, which you choose based on your use case.
Integration with AWS Services
KMS integrates with a wide range of AWS services spanning storage, databases, analytics, and containers. In S3, you can specify a KMS key for default bucket encryption, and uploaded objects are automatically encrypted. In EBS, simply enabling encryption when creating a volume protects on-disk data with a KMS key. RDS and Aurora use KMS keys for database instance encryption, and backups and snapshots are automatically encrypted as well. All these integrations work transparently, requiring no application changes.
Pricing
KMS pricing consists of key storage charges and API request charges. AWS managed keys are free, and customer managed keys cost $1 per key per month, and API requests cost $0.03 per 10,000 requests (as of August 2026). API request charges also apply when AWS services call KMS, but envelope encryption minimizes KMS API calls even when encrypting large volumes of data.
Things to Watch Out For
- KMS key deletion has a 7-30 day waiting period to prevent accidental deletion. Deleting a key makes encrypted data permanently unrecoverable, so proceed with caution
- Enabling automatic rotation for customer managed keys generates new key material once a year by default. Old key material is retained for decryption, so existing data is not affected
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
If this page and the official documentation disagree, treat the official documentation as authoritative.
