AWSDOP-C02
On this page
Beginner-friendly overview

KMS

KMS is AWS's managed service for creating and controlling the cryptographic keys used to encrypt your data. When you encrypt an S3 object, an RDS database, an EBS volume, or a Secrets Manager secret, KMS is the service that holds the key and performs the encryption on your behalf.

Why Key Management Is Hard

Encryption is only as secure as the key protecting the data. If the key is stored alongside the data it encrypts, the encryption provides little protection. If the key is lost, the data is permanently inaccessible. Key management — creating, storing, rotating, auditing, and retiring keys — is a discipline unto itself.

KMS solves this by being a dedicated, hardened key store backed by hardware security modules (HSMs). Your keys never leave KMS in plaintext. When a service needs to encrypt or decrypt, it sends the data to KMS and KMS does the work — the key itself is never exposed.

How Encryption Works in Practice

Most AWS services integrate with KMS through envelope encryption. KMS manages a master key (the KMS key). When you encrypt data, KMS generates a temporary data key, encrypts your data with the data key, then encrypts the data key with the master key and stores the encrypted data key alongside your data. To decrypt, KMS decrypts the data key using the master key, then uses the data key to decrypt your data. The master key never leaves KMS.

Envelope encryption — the KMS key encrypts data keys, data keys encrypt data Inside KMS — never leaves KMS key (master) encrypts/decrypts data keys Data key (plaintext) used in memory, then wiped Data key (encrypted) safe to store anywhere GenerateDataKey Your data (any size) encrypted → ciphertext encrypts S3 / disk stores both: ciphertext + encrypted data key To decrypt: send the encrypted data key back to KMS → get the plaintext data key → decrypt locally. Lose access to the KMS key = all of it unreadable.

KMS Key Types

AWS managed keys — automatically created by AWS services (like S3 or RDS) on your behalf. AWS handles rotation. You can see them but can't manage or use them directly outside the service that created them.

Customer managed keys (CMK) — keys you create and control. You define who can use them (key policy), enable automatic annual rotation, disable them if needed, and audit all usage in CloudTrail. Use these when you need control over the key lifecycle or need to share a key across multiple services.

AWS owned keys — fully managed by AWS, not visible in your account. Used by some services as a default. No cost, no visibility.

The three key types are hotel keys: AWS owned = the hotel's own master key — you never see it, free · AWS managed = a key the front desk holds with your name on it (aws/s3) — staff use it for you, you can watch but not touch · Customer managed (CMK) = the key in your pocket — yours to share, rotate, disable, delete. Anything cross-account requires the key in YOUR pocket — a CMK, never an AWS managed or AWS owned key.

Every Encryption Action Is Logged

Every KMS API call — every encrypt, decrypt, key creation, and key use — is recorded in CloudTrail. This audit trail is one of KMS's most important security features: you can prove exactly who decrypted what, and when.