AWS KMS
Managed service for creating and controlling encryption keys used across AWS services and your own apps.
Verified against AWS documentation · 2026-08-27
Key facts
- 01Keys never leave KMS unencrypted — you send data to the key, not the key to your data
- 02Direct Encrypt/Decrypt caps at 4 KB; anything bigger uses envelope encryption (KMS encrypts a data key, the data key encrypts your data)
- 03Three key types: AWS owned (invisible, free), AWS managed (aws/service, free storage), customer managed (you control policy, rotation, deletion)
- 04Regional service — keys don't cross Regions; multi-region keys are replicas billed separately
- 05Deletion is never instant: 7–30 day mandatory waiting period, and a deleted key means permanently unreadable data
- 06Every key use is logged in CloudTrail — this is the audit answer, not an add-on
Exam triggers
Phrases and scenarios that point here.
- "Encryption at rest", "manage encryption keys", "control who can decrypt" → KMS
- "Encrypt data larger than 4 KB" → envelope encryption with data keys, not direct Encrypt
- "Audit key usage" → KMS + CloudTrail
- Compliance requires customer-controlled keys → customer managed key, not AWS managed
- "Dedicated single-tenant hardware" / FIPS 140-2 Level 3 → CloudHSM (or KMS custom key store), not plain KMS
Not this service
- Storing/rotating database passwords or API keys → Secrets Manager
- Dedicated single-tenant HSM you fully control → CloudHSM
- SSL/TLS certificates for load balancers and CloudFront → ACM
Use cases
- 01One customer managed key per environment (prod/staging) so a leaked staging credential can never decrypt production S3 objects
- 02Cross-account key policy letting an analytics account decrypt a data lake bucket without copying data or sharing credentials
- 03Envelope encryption in an app storing signed contracts — KMS wraps one data key per document, so revoking the KMS key revokes everything at once
- 04Meeting an auditor's 'prove who decrypted customer records and when' requirement purely from CloudTrail KMS events
- 05Disabling (not deleting) a key during an incident to instantly cut off all decryption while keeping the option to recover
How it's charged
- 01$1/month per customer managed key, prorated hourly — charged whether the key is used or not, so orphaned keys are silent recurring spend
- 02API requests: $0.03 per 10,000 symmetric requests after 20,000 free per month; asymmetric operations cost more and are excluded from the free tier
- 03AWS managed keys have no storage charge — requests against them still bill
- 04Multi-region key replicas each bill as their own $1/month key
- 05The real bill driver is request volume from integrated services (S3 SSE-KMS reads, EBS, Secrets Manager) — S3 Bucket Keys and data key caching cut it
