- Home
- Encryption Key Management Software
- AWS Key Management Service
AWS Key Management Service
What it is
AWS Key Management Service (KMS) creates and controls cryptographic keys for encrypting data and digitally signing it. It centralizes key lifecycle and permissions, including separate control over key administration and key use. KMS supports symmetric encryption, asymmetric signing or encryption key pairs, and HMAC generation and verification. It integrates with AWS services such as Amazon S3, EBS, RDS, DynamoDB, Lambda and CloudTrail. When CloudTrail is enabled, requests can be recorded with the user, time, API action and key involved. AWS says key material and cryptographic operations are protected by hardware security modules validated to FIPS 140-3 Security Level 3; plaintext keys are not written to disk and are used in HSM volatile memory for requested operations. Multi-Region keys share material and IDs for cross-Region workflows. The service scales with encryption demand, subject to default key-count and request-rate limits. The listed charge is $1 a month per KMS key, prorated hourly; API requests are charged separately, with a 20,000-request monthly free tier across Regions subject to exclusions.
For and against
For
- Supports symmetric, asymmetric and HMAC operations.
- Integrates with S3, EBS, RDS, DynamoDB, Lambda and CloudTrail.
- CloudTrail can record request details when enabled.
- Multi-Region keys support cross-Region workflows.
- Plaintext keys are not written to disk, AWS states.
Against
- API requests are charged separately.
- Default key-count and request-rate limits apply.
- Custom key stores are unavailable in two AWS China Regions.
- Custom key stores do not support asymmetric KMS keys.
The verdict
KMS provides centralized key controls and integrates with several AWS services. Account for separately charged API requests and default limits when considering its $1 a month per-key charge.
Who it suits
KMS suits teams that need to manage cryptographic keys for encryption or signing within AWS-connected workflows. External key stores may suit customers who want key material held in an external manager they own and manage.
Plans and prices
AWS KMS
20,000 requests/month free tier across Regions; asymmetric-key requests and specified key-pair operations are excluded
Read 29 Sep 2026 · aws.amazon.com
On the record
- Application libraries
- The AWS Encryption SDK supports KMS as a key provider for encrypting and decrypting data locally in applications.aws.amazon.com · read 29 Sep 2026
- Auditing
- When CloudTrail is enabled, KMS requests are recorded with details such as the user, time, API action, and key used.aws.amazon.com · read 29 Sep 2026
- Compliance
- AWS lists KMS validations or certifications including SOC 1, SOC 2, SOC 3, PCI DSS Level 1, FedRAMP, HIPAA, and FIPS 140-3.aws.amazon.com · read 29 Sep 2026
- Cryptographic operations
- KMS supports symmetric encryption, asymmetric signing or encryption key pairs, and generation and verification of HMACs.aws.amazon.com · read 29 Sep 2026
- Custom key store limits
- Custom key stores are unavailable in the AWS China (Beijing) and AWS China (Ningxia) Regions and do not support asymmetric KMS keys.aws.amazon.com · read 29 Sep 2026
- External key stores
- With an external key store, keys are generated and stored in an external key manager that the customer owns and manages, and key material stays in that HSM.aws.amazon.com · read 29 Sep 2026
- Integrations
- KMS integrates with AWS services including Amazon S3, Amazon EBS, Amazon RDS, Amazon DynamoDB, AWS Lambda, and AWS CloudTrail.aws.amazon.com · read 29 Sep 2026
- Key management
- KMS provides centralized control over key lifecycles and permissions, including separate control over who manages keys and who uses them.aws.amazon.com · read 29 Sep 2026
- Key protection
- KMS uses hardware security modules validated to FIPS 140-3 Security Level 3 to protect key material and cryptographic operations.aws.amazon.com · read 29 Sep 2026
- Multi-Region keys
- Multi-Region keys share key material and key IDs across Regions and can support cross-Region workflows such as disaster recovery.aws.amazon.com · read 29 Sep 2026
- Plaintext keys
- AWS states that plaintext keys are never written to disk and are used only in HSM volatile memory for the requested cryptographic operation.aws.amazon.com · read 29 Sep 2026
- Post-quantum support
- KMS supports post-quantum TLS using ML-KEM and post-quantum signatures using ML-DSA.aws.amazon.com · read 29 Sep 2026
- Pricing exclusions
- AWS-managed and AWS-owned key creation and storage are not charged, but API requests to AWS-managed keys are chargeable.aws.amazon.com · read 29 Sep 2026
- Purpose
- AWS KMS creates and controls cryptographic keys used to encrypt data and digitally sign it.aws.amazon.com · read 29 Sep 2026
- Scaling and limits
- KMS automatically scales as encryption needs grow, has default limits for key counts and request rates, and allows customers to request higher limits.aws.amazon.com · read 29 Sep 2026
