AWS Key Management Service (KMS)
AWS Key Management Service (KMS) is a global Amazon Web Services service that creates, stores, and manages encryption keys, providing data security at rest and access control over encryption, decryption, and re-encryption operations.
AI Practitioner focus
- Use KMS keys with supported services to encrypt training data, embeddings, model artifacts, logs, and secrets at rest; use TLS for data in transit.
- KMS manages cryptographic keys and policy/audit controls. It does not store credentials (AWS Secrets Manager) or decide who should access AI data (AWS Identity and Access Management (IAM)).
Key points
- Offers SDKs for different languages to add digital signature capability to application code.
- Automatic key rotation on a customer managed key defaults to every 365 days, but the rotation period is now configurable to anywhere from 90 days to 2,560 days (about 7 years); on-demand rotation can also be triggered at any time regardless of the automatic schedule (older CLF-C02 material still describes rotation as fixed at once a year). Automatic/on-demand rotation only applies to symmetric encryption keys with AWS-generated key material — asymmetric keys, HMAC keys, and keys in custom key stores must be rotated manually.
- AWS KMS preserves all previous versions of the cryptographic material so that data encrypted under any prior key version can still be decrypted; rotated key material is not removed until the KMS key itself is deleted.
- Customer managed keys (formerly called “customer managed CMKs”) — created, managed, and used by the customer; support the full range of cryptographic operations and rotation options above.
- AWS managed keys — created and used by an AWS service on the customer’s behalf inside the customer’s account; rotated automatically every year, a schedule the customer cannot change.
- AWS owned keys — a third key type, used internally by AWS services across multiple accounts; never visible in the customer’s account or the KMS console, with no ability to view, audit, or control their rotation.
- Multi-Region keys let you create a primary KMS key and replica keys in other Regions that share the same key material and key ID (prefixed
mrk-), so data encrypted in one Region can be decrypted in another without re-encrypting or making a cross-Region API call — useful for disaster recovery and global applications; they are not a global, single key spanning Regions. - Backs encryption for Amazon Elastic Block Store (EBS) volumes and server-side encryption of Amazon S3 objects and buckets (SSE-S3 uses Amazon S3-managed keys; SSE-KMS uses AWS KMS keys); customers must enable encryption on these resources themselves — it is not applied automatically by default.
- Uses hardware security modules (HSMs) validated under FIPS 140-2 to protect keys, and integrates with Amazon Cloudtrail to log every key usage for auditing.
- Access to a KMS key is controlled by its key policy (a resource-based policy attached to the key), separate from IAM identity policies.
- Manages encryption keys, not application secrets — AWS Secrets Manager stores and automatically rotates credentials such as database passwords and API keys, optionally using a KMS key to encrypt them under the hood.
- For a dedicated, single-tenant hardware security module you control directly — required for FIPS 140-2 Level 3 compliance — use AWS CloudHSM instead of KMS’s shared, multi-tenant HSMs.