Loading…
While this loads — worth knowing
ElastiCache RedisnotElastiCache Memcached
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Loading…
While this loads — worth knowing
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Creates and guards the keys that encrypt your data, lets a policy decide every use of them, and hands out data keys for envelope encryption.
Where KMS takes you5 steps, all open
AWS KMS creates and keeps the keys that encrypt your data. The keys stay inside KMS: you ask it to encrypt, decrypt or make a data key, and a key policy decides whether you may. Every use can be recorded in CloudTrail.
Most services use it for you. S3, EBS, RDS, DynamoDB and Secrets Manager encrypt with a KMS key when encryption is on. For data of your own, KMS hands out data keys and your code encrypts with them: envelope encryption.
A bank vault. The master keys never leave it. You bring the small key to your own box, the vault seals it with a master key, and you keep the sealed key with the box. To open the box, you bring the sealed key back, and the vault unseals it if its rules say you may.
KMS keyData keyEnvelope encryptionKey policyGrantRotationIs the key in the Region the call is made in? A key is Regional, unless it is a multi-Region key with a replica there.
Does the key policy allow the caller, or let the account's IAM policies decide? Without the key policy, nothing gets in.
Where the key policy defers to the account, does the caller's IAM policy allow kms:Decrypt on this key?
Is the key enabled? A disabled key, or one pending deletion, cannot be used.
Pick a case to follow the Decrypt call through each check.
One key, one rulebook. S3, EBS and RDS all encrypt under the same customer managed key, so its key policy decides who can read any of that data.
Every use is on record. Calls to KMS are logged in CloudTrail, so you can see which principal used which key, and when.
Services use grants. When a service such as EBS needs the key while it works for you, it is given a grant: a narrow permission that can be retired when the work is done.
The key policy comes first. Every key has exactly one, and IAM policies give access to the key only if the key policy lets them.
Keep the roles apart. Let key administrators manage a key without using it, and key users use it without managing it.
Another account can use your key when your key policy allows that account, and that account's IAM policies allow its own users.
Deletion is final. A scheduled deletion waits 7 to 30 days, 30 by default. After that, nothing encrypted under the key can be decrypted, so disable a key you are unsure about instead.
A monthly charge for each customer managed key. Rotations add to it, but only the first two.
A charge per request, with 20,000 requests a month free.
AWS managed keys have no monthly charge, though their use is charged per request. AWS owned keys cost you nothing.
Prices change, so none are printed here. Check the KMS pricing page on aws.amazon.com.
| Key type | Who controls it | Rotation | Charged | Choose it when |
|---|---|---|---|---|
| Customer managed | You: policy, rotation, deletion | Optional, on the period you set | Monthly per key, plus requests | You need control, audit, or sharing across accounts |
| AWS managed | The service, under an aws/ alias | Every year, always | Requests only | A service's default, with no control needed |
| AWS owned | AWS, out of your sight | Up to the service | Nothing | You never need to see or manage the key |
| Service | Holds | Changes it | Choose it when |
|---|---|---|---|
| KMS | Encryption keys that stay inside it | New key material, yearly by default | Encrypting data |
| Secrets Manager | Passwords, API keys, tokens | The secret itself, on a schedule | Credentials an application reads |
| ACM | TLS certificates | Renews the certificates it issued | HTTPS for a load balancer or CloudFront |
encrypt a 1 MB file with a KMS keyEnvelope encryption with a data key
Encrypt takes at most 4,096 bytes; bigger data is encrypted locally with a data key.
control and audit who uses the key, and rotate it yearlyA customer managed key
Only with one do you write the key policy and choose rotation.
the IAM policy allows kms:Decrypt, yet access is deniedCheck the key policy
IAM counts only when the key policy lets the account use it.
rotate the key without re-encrypting any dataAutomatic rotation
The key ID stays the same, and old material is kept to decrypt what it encrypted.
encrypt in one Region and decrypt in another, with no call across RegionsMulti-Region keys
The replicas share the key ID and key material.
a key was scheduled for deletion by mistake an hour agoCancel the deletion
It waits 7 to 30 days before it is gone.
turn an existing key into a multi-Region keyNot possible
Create a new multi-Region key and re-encrypt under it.
share a snapshot encrypted with an AWS managed keyRe-encrypt it with a customer managed key
An AWS managed key's policy cannot be changed, so other accounts can never be let in.
store the database password in KMSSecrets Manager, not KMS
KMS holds keys; Secrets Manager stores and rotates secrets, encrypted with KMS.
A company must encrypt files of up to 2 GB inside its application before storing them. The keys must rotate automatically every year, every use of a key must be auditable, and the security team must control who can use them. What should a solutions architect do?
A function receives uploaded documents and must encrypt each one before storing it, with keys the security team controls by policy, rotated every year, and every use recorded. Where does the function get a key for each document?
4,096 bytes at most.7 to 30 days; disable if unsure.This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.
Next: Secrets ManagerStores database passwords, API keys and tokens, hands the current one to applications when they run, and rotates them on a schedule.
Open Secrets ManagerEvery fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.