AWS Key Management Service

Service that manages data encryption keys on AWS.

Service for creating and managing encryption keys. Used for at-rest encryption in S3, EBS, RDS, DynamoDB, and more.

• Encrypting S3 objects
• Encrypting EBS volumes
• At-rest encryption for DynamoDB and RDS

• Key management service used for at-rest encryption
• Offers AWS managed keys and customer managed keys
• Access is controlled via key policies and IAM

• Key policies are critical for cross-account usage
• Understand key rotation
• Design integration with services that use the keys for encryption

AWS Key Management Service (KMS) is a managed service for creating, managing, and using keys for data encryption. KMS keys created in KMS (formerly known as CMKs / customer master keys) are broadly divided into three types: AWS-managed keys managed by AWS, customer-managed keys created and managed by the user, and AWS-owned keys. KMS is integrated with many AWS services (S3, EBS, RDS, DynamoDB, Secrets Manager, etc.) and can be used as keys for encryption at rest. Access control to KMS keys is performed by combining "key policies" and "IAM policies". A key policy is a JSON document configured per KMS key, defining who can administer the key and who can use it for encryption / decryption. When sharing a KMS key across accounts, it is a frequently asked exam point that explicit permission must be granted not only in the IAM policy on the consuming account side but also in the key policy. Customer-managed keys can be configured for automatic key rotation (yearly, etc.). In the exam context, questions such as "which service manages keys used for encryption at rest?" and "how should key management be designed when sharing encrypted data across accounts?" are asked. AWS-managed keys incur no charges and are easy to start using, but their key policies cannot be customized, so when cross-organizational fine-grained access control is required, customer-managed keys are the choice. Customer-managed keys incur monthly key storage charges and usage-based charges based on the number of API requests. When you delete a KMS key, data encrypted with that key can no longer be decrypted, so the deletion operation has a minimum waiting period of 7 days.

• What is AWS Key Management Service (AWS Official Documentation)
• AWS Key Management Service (AWS Official)

Last updated: 2026-06-01