Learn
AWS
Security, identity & compliance
KMS

AWSGCP laterAzure later

KMSAWS Key Management Service

Security, identity & complianceCore service · full depthFree while we build the libraryChecked against AWS docs · 15 Sept 2026

Creates and guards the keys that encrypt your data, lets a policy decide every use of them, and hands out data keys for envelope encryption.

In the examsSolutions Architect – AssociateHIGHSolutions Architect – ProfessionalMEDDeveloper – AssociateHIGHSysOps Administrator – AssociateMEDSecurity – SpecialtyHIGHData Engineer – AssociateMED

Where KMS takes you5 steps, all open

I know the problem it solves
I can picture it
I know when to choose it
I can use it in a design
I can answer an exam question

What & why

The keys, and who may use them

AWS KMS creates and keeps the keys that encrypt your data. The keys stay inside KMS: you ask it to encrypt, decrypt or make a data key, and a key policy decides whether you may. Every use can be recorded in CloudTrail.

Most services use it for you. S3, EBS, RDS, DynamoDB and Secrets Manager encrypt with a KMS key when encryption is on. For data of your own, KMS hands out data keys and your code encrypts with them: envelope encryption.

Reach for it when

data at rest must be encrypted with keys you control and can audit
a key must be rotated automatically
encrypted data must be read in more than one Region
another AWS account must use your key

It is the wrong tool when

a password or API key must be stored and rotated: that is Secrets Manager
a website needs TLS certificates: that is ACM

Mental model

The bank vault that seals your key

A bank vault. The master keys never leave it. You bring the small key to your own box, the vault seals it with a master key, and you keep the sealed key with the box. To open the box, you bring the sealed key back, and the vault unseals it if its rules say you may.

A master key in the vaulta key that never leaves KMSKMS key

The small key to your boxa key your code encrypts data withData key

Sealing the small keyencrypting the data key under the KMS keyEnvelope encryption

The vault's rulebookwho may use each key, and howKey policy

A visitor's passa narrow permission for a serviceGrant

Changing the lock each yearnew key material, same key IDRotation

How it works

Envelope encryption in four steps

Create a keyA customer managed key, with a key policy that says who may administer it and who may use it.
Ask for a data keyGenerateDataKey returns the data key twice: in plaintext, and encrypted under the KMS key.
Encrypt locallyEncrypt the data with the plaintext key, discard that copy, and store the encrypted key beside the data.
Decrypt laterSend the encrypted data key to Decrypt; if the policies allow it, KMS returns the plaintext key.

Encrypt directly: 4,096 bytesat most, with a symmetric key
Key policy: One per keyevery key has exactly one
Auto rotation: 365 daysby default; you can set the period
Deletion wait: 7 to 30 days30 by default
Scope: One Regionunless it is a multi-Region key
Key types: Threecustomer managed, AWS managed, AWS owned

Region
Is the key in the Region the call is made in? A key is Regional, unless it is a multi-Region key with a replica there.
Key policy
Does the key policy allow the caller, or let the account's IAM policies decide? Without the key policy, nothing gets in.
IAM policy
Where the key policy defers to the account, does the caller's IAM policy allow kms:Decrypt on this key?
Key state
Is the key enabled? A disabled key, or one pending deletion, cannot be used.

Pick a case to follow the Decrypt call through each check.

Architecture

One key behind several services

S3, EBS and RDS each encrypt under the same customer managed key, and every call to KMS is logged.

One key, one rulebook. S3, EBS and RDS all encrypt under the same customer managed key, so its key policy decides who can read any of that data.

Every use is on record. Calls to KMS are logged in CloudTrail, so you can see which principal used which key, and when.

Services use grants. When a service such as EBS needs the key while it works for you, it is given a grant: a narrow permission that can be retired when the work is done.

Security

Policy first, deletion last

The key policy comes first. Every key has exactly one, and IAM policies give access to the key only if the key policy lets them.

Keep the roles apart. Let key administrators manage a key without using it, and key users use it without managing it.

Another account can use your key when your key policy allows that account, and that account's IAM policies allow its own users.

Deletion is final. A scheduled deletion waits 7 to 30 days, 30 by default. After that, nothing encrypted under the key can be decrypted, so disable a key you are unsure about instead.

Cost

How you are charged, not what it costs today

A monthly charge for each customer managed key. Rotations add to it, but only the first two.

A charge per request, with 20,000 requests a month free.

AWS managed keys have no monthly charge, though their use is charged per request. AWS owned keys cost you nothing.

Prices change, so none are printed here. Check the KMS pricing page on aws.amazon.com.

Comparison

Three kinds of key, and three services

Key type	Who controls it	Rotation	Charged	Choose it when
Customer managed	You: policy, rotation, deletion	Optional, on the period you set	Monthly per key, plus requests	You need control, audit, or sharing across accounts
AWS managed	The service, under an aws/ alias	Every year, always	Requests only	A service's default, with no control needed
AWS owned	AWS, out of your sight	Up to the service	Nothing	You never need to see or manage the key

Service	Holds	Changes it	Choose it when
KMS	Encryption keys that stay inside it	New key material, yearly by default	Encrypting data
Secrets Manager	Passwords, API keys, tokens	The secret itself, on a schedule	Credentials an application reads
ACM	TLS certificates	Renews the certificates it issued	HTTPS for a load balancer or CloudFront

SAA traps

The phrase in the question, and what it means

encrypt a 1 MB file with a KMS keyEnvelope encryption with a data key

Encrypt takes at most 4,096 bytes; bigger data is encrypted locally with a data key.

control and audit who uses the key, and rotate it yearlyA customer managed key

Only with one do you write the key policy and choose rotation.

the IAM policy allows kms:Decrypt, yet access is deniedCheck the key policy

IAM counts only when the key policy lets the account use it.

rotate the key without re-encrypting any dataAutomatic rotation

The key ID stays the same, and old material is kept to decrypt what it encrypted.

encrypt in one Region and decrypt in another, with no call across RegionsMulti-Region keys

The replicas share the key ID and key material.

a key was scheduled for deletion by mistake an hour agoCancel the deletion

It waits 7 to 30 days before it is gone.

turn an existing key into a multi-Region keyNot possible

Create a new multi-Region key and re-encrypt under it.

share a snapshot encrypted with an AWS managed keyRe-encrypt it with a customer managed key

An AWS managed key's policy cannot be changed, so other accounts can never be let in.

store the database password in KMSSecrets Manager, not KMS

KMS holds keys; Secrets Manager stores and rotates secrets, encrypted with KMS.

Scenario

Exam style, marked when you answer

A company must encrypt files of up to 2 GB inside its application before storing them. The keys must rotate automatically every year, every use of a key must be auditable, and the security team must control who can use them. What should a solutions architect do?

Practice

Fill the gap, the way the challenges work

A function receives uploaded documents and must encrypt each one before storing it, with keys the security team controls by policy, rotated every year, and every use recorded. Where does the function get a key for each document?

API Gateway (REST)· Upload APILambda· Encrypting functionPick a service below

Quick revision

The night before the exam

What: Keys that stay inside KMS; every use decided by policy.
Envelope: The data key encrypts the data; KMS encrypts the data key.
Limit: Encrypt directly: 4,096 bytes at most.
Key policy: One per key; IAM counts only if it allows.
Key types: Customer managed, AWS managed, AWS owned.
Rotation: Yearly by default; same key ID, old material kept.
Deletion: A wait of 7 to 30 days; disable if unsure.
Multi-Region: Same ID and material in other Regions; never by conversion.

This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.

Next: Secrets ManagerStores database passwords, API keys and tokens, hands the current one to applications when they run, and rotates them on a schedule.

Open Secrets Manager

Checked against

Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.