AWS Key Management Service

AWS Key Management Service is a regional managed service that creates, stores, and controls cryptographic keys used to protect data across AWS services and customer applications. It provides APIs for encryption, decryption, signing, verification, and data key generation while storing key material in AWS-managed hardware security modules. KMS typically sits as the central key control plane in an AWS architecture, invoked by AWS services and customer applications to perform cryptographic operations without exposing raw key material.

🗂 Resource Category

Security, Identity, and Compliance • Management and Governance

🧠 Exam Memory Hook

Think: "Centralized HSM-backed key control for AWS services and apps = AWS KMS"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and maintains the KMS service control plane, API endpoints, regional infrastructure, and the underlying HSMs used to protect key material; AWS secures and patches the physical infrastructure and managed service platform, and provides integration points for AWS services and IAM. AWS also ensures availability of the KMS API endpoints according to the service model and manages FIPS-validated HSM modules where applicable. AWS does not manage customer key policies, IAM policies, or customer application configuration.

Customer responsibilities: The customer configures key creation, key policies, IAM policies, grants, key usage permissions, key rotation settings, and deletion schedules; the customer also decides which keys to use for which resources, monitors KMS usage and audit logs (for example via AWS CloudTrail), and implements application-side envelope encryption if required. Customers are responsible for securely managing application credentials that call KMS, controlling access to plaintext data keys, and designing cross-account or cross-region key usage patterns.

Patching responsibilities: AWS patches and maintains the physical infrastructure and the managed KMS platform, including the HSM firmware and service runtime; AWS patches the hypervisor and underlying host systems used to deliver the managed service. Guest operating systems and application runtimes are not applicable to KMS's managed platform and therefore are not customer patching responsibilities for KMS itself. The customer patches and maintains their application code, libraries, dependencies, and any guest operating systems or container images used by their applications that call KMS.

🏗 Typical Architecture

💡 Top 5 Features

Creates and manages symmetric and asymmetric customer master keys (CMKs) for cryptographic operations.
Supports envelope encryption by generating data keys without exposing key material to callers.
Provides key policies, IAM integration, and grants for fine-grained access control to keys.
Key material is protected by AWS-managed HSMs that meet FIPS-related validation standards where available.
Offers auditability of key usage through integration with AWS CloudTrail and KMS API logging.

✅ Top 5 Use Cases

Perform envelope encryption for large datasets (generate data key in KMS, encrypt data client-side or in-service).
Provide centralized key lifecycle management and access control for multiple AWS services and applications.
Use asymmetric keys for signing and verification workflows without exporting private key material.
Encrypt block storage and database credentials by integrating KMS with Amazon EBS and Amazon RDS encryption features.
Encrypt secrets stored in AWS Secrets Manager or similar services using customer-managed CMKs.

🏗 Architecture Placement

AWS KMS sits in the control plane as the regional key management service; AWS services (for example S3, EBS, RDS) and customer applications call KMS APIs to perform cryptographic operations or to generate data keys. IAM and key policies control who and what can use keys, while CloudTrail records KMS API activity for auditing. KMS does not host customer data but protects encryption keys and can be used across services and applications depending on account and regional configuration.

🎯 Commonly Used With

- Amazon S3
- Amazon EBS
- Amazon RDS
- AWS Identity and Access Management
- AWS CloudTrail

🌍 5 Real-World Examples

A bank stores encrypted customer documents in Amazon S3 and uses AWS KMS CMKs to centralize key control and produce audit logs for access to cryptographic operations.
A healthcare provider encrypts Amazon RDS databases with KMS-managed keys to separate key management from data storage and enforce access controls.
A retail platform uses AWS KMS to generate data keys for encrypting transaction logs in Amazon S3, keeping key material separate from the encrypted objects.
A government software distribution pipeline uses asymmetric keys in AWS KMS to perform digital signatures for released binaries while key material remains in AWS-managed HSMs.
A SaaS vendor creates per-tenant customer-managed CMKs and enforces usage through key policies and IAM to isolate tenant data encryption keys.

🎓 AWS Exam Clues

Choose KMS when you need centralized, auditable, AWS-managed key storage with HSM protection for cryptographic operations.
Look for envelope encryption requirements (generate data keys and keep plaintext keys short-lived) as an indicator to use KMS.
If the question emphasizes key policies, grants, or IAM integration for encryption key access control, KMS is relevant.
Consider KMS when integrated AWS service encryption (for example SSE-KMS for S3 or EBS/RDS encryption) is required.
If cross-account or cross-service key use is needed, expect configuration of key policies or grants rather than implicit access.

📝 Quick Revision

AWS KMS is a regional managed service that creates and controls cryptographic keys used by AWS services and applications. Use it for centralized key lifecycle, HSM-backed protection, and auditable key usage; pay attention to key policy design, cross-account grants, and monitoring of API usage.

🏷 Keywords

Customer Master Key • CMK • data key • envelope encryption • GenerateDataKey • GenerateDataKeyWithoutPlaintext • key policy • grant • automatic key rotation • hardware security module • KMS API • CloudTrail logging