AWS Key Management Service (KMS)
- What it is
- Create, store, rotate, and control cryptographic keys used to encrypt data across AWS services.
- Integrated with nearly every AWS service (S3, EBS, RDS, Lambda, Secrets Manager).
- Key concepts
- AWS managed keys — created and rotated by AWS for a service, free, minimal control.
- Customer managed keys (CMK) — you define the key policy, rotation, and who may use it. Small monthly charge plus API calls.
- Automatic annual key rotation; every use is logged to AWS CloudTrail for audit.
- Keys never leave KMS unencrypted; multi-tenant FIPS 140-3 validated hardware security modules.
- Not to be confused with
- AWS CloudHSM (Hardware Security Module) — single-tenant, dedicated hardware you fully control, with FIPS 140-2 Level 3 and no AWS access to your keys. Required when regulators demand exclusive key custody.
- AWS Secrets Manager — stores secrets (passwords, API keys) and uses KMS to encrypt them. Different job.