AWS Key Management Service
Encryption key management
Create and manage encryption keys; services like S3, EBS, RDS, DynamoDB… call KMS to encrypt data, and every key use is logged.
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?Yes
- Managed by AWS
- In examsCLF · SAA · DVA · SOA
Think of it asLike a key vault: the key never leaves the vault; only authorized people can ask the vault to unlock things.
Where does KMS fit?
A real example, step by step
- A company stores customer records in S3 and RDS, and regulations require encryption and knowing who used the keys.
- You create a customer managed key in KMS with a key policy: the Security team administers it, the app may only encrypt/decrypt.
- The S3 bucket defaults to SSE-KMS with that key; RDS uses the same key when the database is created.
- The key material never leaves KMS, and every use of the key is recorded in CloudTrail for auditing.
- You turn on automatic key rotation; old data can still be decrypted without re-encrypting it.
When to use it
✓ Use it when
Encrypting data at rest, controlling who can decrypt.
✗ Avoid it when
You need your own dedicated, single-tenant HSM → CloudHSM.
Common uses
- Encrypt S3, EBS, RDS, DynamoDB with your own keys
- Encrypt data inside applications (envelope encryption)
- Digital signing with asymmetric keys
- Control who can decrypt via key policies
KMS, Secrets Manager or ACM?
| KMS |  Secrets Manager |  ACM | |
|---|---|---|---|
| Manages | Encryption keys | Passwords, API keys | SSL/TLS certificates |
| Used to | Encrypt stored data | Let apps fetch secrets at run time | Enable HTTPS |
| Automatic rotation/renewal | Automatic key rotation | Automatic password rotation | Automatic certificate renewal |
| Billing | Per key per month + calls | Per secret per month + calls | Public certificates are free |
What does it cost?
- Pricing model: $1/month per customer managed key + ~$0.03/10,000 requests. AWS managed keys have no storage charge.
- Free tier: Always Free: 20,000 requests/month.
S3 SSE-KMS with millions of objects makes every request call KMS — enable S3 Bucket Key to cut this by up to ~99%; creating separate keys for every small thing.
You must control keys yourself, rotate them, separate duties and audit use → SSE-KMS with a customer managed key. You don't want to manage keys at all → SSE-S3. The same key in several regions → a multi-Region key. A dedicated single-tenant HSM is required → CloudHSM.
Try real exam questions
1A company is preparing to deploy a data lake on AWS. A solutions architect must define the encryption strategy for data at rest in Amazon S3. The company's security policy states: Keys must be rotated every 90 days. Strict separation of duties between key users and key administrators must be implemented. Auditing key usage must be possible. What should the solutions architect recommend?
- AServer-side encryption with AWS KMS managed keys (SSE-KMS) with customer managed customer master keys (CMKs)
- BServer-side encryption with AWS KMS managed keys (SSE-KMS) with AWS managed customer master keys (CMKs)
- CServer-side encryption with Amazon S3 managed keys (SSE-S3) with customer managed customer master keys (CMKs)
- DServer-side encryption with Amazon S3 managed keys (SSE-S3) with AWS managed customer master keys (CMKs)
Show answer
Correct answer: A
SSE-KMS with a customer managed key: you set the rotation period, separate key administration from key use with the key policy, and every use of the key is logged in CloudTrail. AWS managed keys don't allow that; SSE-S3 doesn't use KMS keys.
2A company is building an application in the AWS Cloud. The application will store data in Amazon S3 buckets in two AWS Regions. The company must use an AWS Key Management Service (AWS KMS) customer managed key to encrypt all data that is stored in the S3 buckets. The data in both S3 buckets must be encrypted and decrypted with the same KMS key. The data and the key must be stored in each of the two Regions. Which solution will meet these requirements with the LEAST operational overhead?
- ACreate an S3 bucket in each Region. Configure the S3 buckets to use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Configure replication between the S3 buckets.
- BCreate a customer managed multi-Region KMS key. Create an S3 bucket in each Region. Configure replication between the S3 buckets. Configure the application to use the KMS key with client-side encryption.
- CCreate a customer managed KMS key and an S3 bucket in each Region. Configure the S3 buckets to use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Configure replication between the S3 buckets.
- DCreate a customer managed KMS key and an S3 bucket in each Region. Configure the S3 buckets to use server-side encryption with AWS KMS keys (SSE-KMS). Configure replication between the S3 buckets.
Show answer
Correct answer: B
A multi-Region KMS key is the same key in both regions, so data encrypted in one region can be decrypted in the other. Two separately created keys are different keys; SSE-S3 doesn't use your KMS key.
Frequently asked questions
What is the difference between KMS and CloudHSM?
KMS is a shared key management service operated by AWS and integrated with most AWS services. CloudHSM gives you dedicated, single-tenant HSM devices with full control over the keys, which suits strict compliance requirements but means more to operate yourself.
What is the difference between AWS managed keys and customer managed keys?
AWS managed keys are created and managed by a service; you can't change their policy or rotation. Customer managed keys are created by you: you write the key policy, turn automatic rotation on or off, share them with other accounts, and pay a monthly fee per key.
How is KMS priced?
Each customer managed key has a monthly fee, plus charges for API calls (encrypt, decrypt, generate data key), with a free monthly request allowance. There is no storage fee for AWS managed keys.
What do AWS exams ask about KMS?
Envelope encryption (using data keys), key policies together with IAM, automatic key rotation, sharing keys with other accounts, multi-region keys, and request quotas when encrypting large volumes of data.