thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Cloud Computing · Intermediate

AWS Key Management Service (AWS KMS)

AWS managed service for creating and controlling cryptographic keys used to encrypt data across AWS services.

Definition

KMS keys are protected by FIPS-validated HSMs and never leave KMS unencrypted. Key types include AWS owned, AWS managed and customer managed keys; customer managed keys allow custom key policies, grants, automatic rotation and imported key material. Services use envelope encryption with data keys generated by KMS, and every use is logged in CloudTrail.

Example

An S3 bucket uses SSE-KMS with a customer managed key whose key policy restricts decrypt to the finance role.

Exam tip

KMS keys are regional; multi-Region keys exist for cross-region use. Encrypt operations directly with KMS are limited to 4 KB, so larger data uses envelope encryption.

Related terms