What is AWS KMS?
AWS KMS (Key Management Service) is a managed service for centrally managing cryptographic keys. KMS enables creation, rotation, and control of encryption keys used to protect data in AWS services and custom applications.
The service uses Hardware Security Modules (HSMs) with FIPS 140-2 certification; CloudHSM offers dedicated single-tenant HSMs with the higher security level. Private keys never leave the HSMs in plaintext. KMS integrates with a large number of AWS services, including S3, EBS, RDS, DynamoDB, Lambda, and Secrets Manager.
AWS KMS is available in virtually all AWS regions, including EU regions for applications with requirements around processing data within the EU. Multi-Region Keys enable global encryption and decryption with an identical key ID across multiple regions.
How Does AWS KMS Work?
KMS is based on envelope encryption: instead of encrypting data directly with the master key (direct encryption is limited to small payloads), KMS generates Data Encryption Keys (DEKs) that encrypt the actual data. The DEK itself is encrypted with the KMS key and stored alongside the data.
Encryption Workflow
Encryption:
- The application calls the
GenerateDataKeyAPI - KMS generates a plaintext DEK and an encrypted DEK
- The application encrypts data locally with the plaintext DEK
- The application stores the encrypted data plus the encrypted DEK
- The plaintext DEK is deleted from memory
Decryption:
- The application calls the
DecryptAPI with the encrypted DEK - KMS checks the key policy and IAM permissions
- KMS decrypts the DEK and returns the plaintext DEK
- The application decrypts data locally with the plaintext DEK
- The plaintext DEK is deleted from memory
Key Types
Symmetric Keys (AES-256): Standard for data encryption with high performance, supporting Encrypt/Decrypt/GenerateDataKey.
Asymmetric Keys (RSA, ECC): Public/private key pairs for Sign/Verify or Encrypt/Decrypt. The public key is exportable, the private key stays in the KMS HSM. Used for digital signatures, PKI integration, and cross-platform encryption.
HMAC Keys: For hash-based message authentication codes (GenerateMac, VerifyMac), such as API request signing or token generation.
Key Policies and Permissions
Every KMS key has a key policy (resource-based policy) defining who may use the key. The key policy is mandatory, and IAM policies can apply additionally. Grants are temporary, delegatable permissions that AWS services automatically create, for example when attaching encrypted volumes.
Typical Use Cases
Encryption at Rest for AWS Services
KMS is the standard mechanism for encryption at rest in AWS and integrates with S3 (SSE-KMS), EBS (encrypted volumes), RDS/Aurora (transparent database encryption), DynamoDB, Lambda, and Secrets Manager, among others.
Client-Side Encryption in Applications
Data can be encrypted within the application before being sent to AWS services, for example via the AWS Encryption SDK, which uses KMS for data key management and offers key caching to reduce API calls.
Compliance and Regulatory Requirements
KMS supports compliance requirements such as HIPAA, PCI DSS, and ISO 27001 through FIPS-certified HSMs and complete CloudTrail audit logs for all key accesses.
Cross-Account Encryption
KMS keys can be shared across accounts, for example via a central security account that manages keys while workload accounts access them through cross-account key policies.
Digital Signatures and PKI
Asymmetric KMS keys support Sign/Verify operations without exporting the private key, for use cases such as code signing, document signatures, or JWT token signing.
Multi-Region Disaster Recovery
Multi-Region Keys enable global encryption and decryption with identical key IDs across multiple regions, for example for disaster recovery scenarios without re-encrypting data.
Best Practices for AWS KMS
Use Customer Managed Keys for production data: AWS Managed Keys are simple but offer no control over key policies. For production data, a custom key policy following least privilege is recommended.
Enable automatic key rotation: Rotation is transparent to applications, since old key material versions are retained for decrypting existing data.
Use encryption context for audit: Additional authenticated data (AAD) that must match during encrypt/decrypt improves traceability in CloudTrail logs.
Apply key policy conditions: Conditions such as kms:ViaService or aws:SourceVpc restrict key usage granularly.
Use separate keys for different purposes: Separation by environment, service, or data classification reduces the blast radius in case of a compromise.
Continuously monitor key usage: CloudWatch metrics, CloudTrail logs, and AWS Config help detect unusual activity such as unused or deleted keys early.
AWS KMS vs. Alternatives
AWS KMS vs. Google Cloud KMS: Both offer symmetric and asymmetric keys with HSM support and automatic rotation. AWS stands out with a very large number of integrated services and an external key store for on-premises HSMs.
AWS KMS vs. Azure Key Vault: Azure Key Vault combines key, secret, and certificate management in one service, while AWS splits these functions across KMS, Secrets Manager, and ACM.
KMS vs. CloudHSM: KMS suits standard compliance requirements with simpler management. CloudHSM is the right choice when FIPS 140-2 Level 3, a single-tenant HSM, or full control over the key lifecycle is required — at correspondingly higher cost.
As multi-cloud experts, we provide vendor-neutral advice on the optimal solution for your requirements.
Integration with innFactory
As an AWS Reseller, innFactory supports you with:
Architecture Design: Designing secure key management architectures with KMS, including key hierarchies, encryption context strategies, and multi-region key design.
Migration: Secure migration of existing encryption solutions to KMS, including re-encryption of data, importing your own keys (BYOK), and CloudHSM migration.
Security & Compliance: KMS implementations with key policy design following least privilege, encryption at rest for sensitive data, and audit trails with CloudTrail.
Performance Optimization: Integrating the AWS Encryption SDK with key caching to reduce KMS API calls, plus monitoring to avoid throttling.
Cost Optimization: Analysis of your KMS usage to identify unused keys and optimize API call patterns.
Contact us for a non-binding consultation on AWS KMS and encryption architectures on AWS.
Available Tiers & Options
AWS Managed Keys
- Automatically created and managed
- No additional key storage costs
- Integration with AWS services
- No key policy control
- No cross-account usage
Customer Managed Keys
- Full control over key policies
- Cross-account access possible
- Optional configurable automatic rotation
- CloudTrail audit logs
- Ongoing cost per key per month
CloudHSM
- Dedicated HSM hardware (FIPS 140-2 Level 3)
- Full control over keys
- Compliance for highest requirements
- Significantly more expensive than standard KMS keys
- More complex management
Typical Use Cases
Frequently Asked Questions
What is AWS KMS?
AWS KMS (Key Management Service) is a managed service for creating and controlling cryptographic keys. KMS integrates with a large number of AWS services such as S3, EBS, RDS, and Lambda for encryption at rest. The service uses Hardware Security Modules (HSMs) with FIPS 140-2 certification and enables central key management, audit trails, and granular access control.
How much does AWS KMS cost?
Customer Managed Keys incur a monthly base fee per key (currently around $1, prorated hourly), plus a fee per API request with a monthly free tier. Asymmetric operations cost more than symmetric ones. AWS Managed Keys are free. CloudHSM is billed separately per HSM per hour and is significantly more expensive than standard KMS keys. Current prices are available on the official AWS pricing page.
How does envelope encryption work?
Envelope encryption is the core principle of KMS: KMS generates Data Encryption Keys (DEKs) that encrypt your data. The DEK itself is encrypted with the KMS key and stored alongside the data. During decryption, KMS retrieves the encrypted DEK, decrypts it, and returns the plaintext DEK. Benefit: arbitrarily large data volumes can be encrypted, even though direct KMS encryption is limited to small payloads.
What is the difference between AWS Managed and Customer Managed Keys?
AWS Managed Keys (e.g., aws/s3, aws/rds) are automatically created when you enable encryption and rotate automatically every year, but you have no control over key policies. Customer Managed Keys give you full control: custom key policies, cross-account access, optional automatic rotation, and CloudTrail logs. Best practice: use Customer Managed Keys for production data with elevated requirements.
How does automatic key rotation work?
For Customer Managed Keys, automatic rotation can be enabled; by default AWS KMS then rotates the key material every 365 days, with a custom rotation period configurable. Old key material versions are retained to decrypt existing data, so rotation is transparent and requires no code changes. AWS Managed Keys rotate automatically every year and are not configurable; asymmetric and HMAC keys only support manual rotation.
Can I import my own keys (BYOK)?
Yes, using Import Key Material you can import your own symmetric keys into KMS, encrypted with a public wrapping key provided by KMS. You can set an expiration date for the imported material and delete it when needed. Imported keys do not support automatic rotation and must be managed externally.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of AWS (official documentation). This page does not represent an offer by AWS.