Security & IAM
AWS Key Management Service
AWS Key Management Service creates and controls cryptographic keys used by applications and integrated AWS services for encryption, decryption, signing, verification, message authentication, and data-key generation.
Explore pricing models, common use cases, infrastructure support, and the AWS services that commonly work with AWS Key Management Service.
AWS Key Management Service pricing and cost programs
Pricing model: Key and API request usage
- On-Demand
- Available
- Reserved Instances or reserved capacity
- Not applicable
- Savings Plans
- Not applicable
- Spot
- Not applicable
Billing dimensions: Customer-managed keys · API requests · External key stores · CloudHSM-related resources
Programs and modes: AWS managed keys · Customer managed keys · Multi-Region keys · XKS
Key storage and cryptographic requests are billed separately; AWS managed keys differ from customer-managed keys.
Free Tier: Available — verify current offers
Pricing reviewed 2026-07-25. Reviewed against the linked official AWS pricing page. Recheck regional rates and program terms before purchase.
Official AWS sources reviewed 2026-07-21.
Why implement AWS Key Management Service?
- Keeps key material in managed cryptographic infrastructure while exposing auditable APIs and integrations with many AWS services.
- Supports symmetric, asymmetric, HMAC, multi-Region, imported-material, custom-key-store, and automatic or on-demand rotation patterns where applicable.
- Enables envelope encryption so applications can encrypt large data efficiently while centralizing control of the protecting key.
How to implement AWS Key Management Service
- Classify data and determine key ownership, Region, separation of duties, recovery, rotation, deletion, residency, and cross-account requirements before choosing key type and origin.
- Create a customer-managed key only when its control is needed, write a recoverable least-privilege key policy, add stable aliases, and grant workloads scoped encryption context through IAM policies or grants.
- Use an AWS Encryption SDK or service integration for envelope encryption, log key operations in CloudTrail, alarm on risky administration, test disabled-key and recovery paths, and schedule deletion only after dependency review.
AWS Key Management Service best practices
- Keep key administrators separate from key users, avoid unrestricted principals and kms actions, constrain cross-account use, and use grants for temporary or service-specific delegation.
- Use encryption context as authenticated additional data and as a policy condition, but never put secrets in it because it can appear in logs.
- Enable appropriate rotation and monitor key age, but understand that rotation does not revoke previously leaked plaintext or automatically re-encrypt existing data; use multi-Region keys only for a real multi-Region cryptographic need.
AWS Key Management Service use cases and server impact
- Envelope encryption for application data
- Service-managed encryption with customer keys
- Digital signing, verification, and HMAC
Replaces most self-managed key-server and HSM orchestration for supported assurance needs, while cryptographic design, permissions, data re-encryption, compromise response, and key lifecycle decisions remain yours.
Official implementation resources
Commonly paired AWS services
- AWS Identity and Access Management — Identity & access
- AWS CloudTrail — API audit logging
- AWS Config — Resource compliance
- AWS Secrets Manager — Store secrets & keys
- Amazon Simple Storage Service — Object storage
- AWS Backup — Centralized backup management
- AWS Private Certificate Authority — Private certificate authorities
Architecture patterns using this service
- Scan uploaded objects for malware and quarantine them on AWS — Land untrusted uploads in a private Amazon S3 bucket, scan them with GuardDuty Malware Protection for S3, route scan results through EventBridge and SQS, and promote only clean objects to a bucket consumers can read.
Planning guides that use AWS Key Management Service
- Amazon FSx planning guide — Use KMS keys where customer-managed encryption control is required.
- AWS CodeArtifact planning guide — Use KMS key policies when the CodeArtifact domain requires customer-managed encryption control.
- Amazon Keyspaces (for Apache Cassandra) planning guide — Use a customer managed KMS key where the table requires encryption control you administer.
- Amazon Macie planning guide — Macie needs access to the KMS keys protecting objects it must decrypt before inspecting them.
- AWS CodeCommit planning guide — CodeCommit repositories are encrypted with KMS keys that stay billed until the repository is removed.