Requests data keys
Cloud / Knowledge library
AWS Key Management Service
Creates and controls keys integrated with AWS services and applications
Why learn AWS Key Management Service?
Teams use AWS Key Management Service to adopt cryptographic key management without building the complete underlying platform themselves.
The problem it solves
Creates, protects, rotates, and audits cryptographic keys
Where it came from
AWS Key Management Service is Amazon Web Services's offering for cryptographic key management. Its closest catalog counterparts are Azure Key Vault Keys and Google Cloud Key Management Service; they address the same broad need but are not feature-for-feature identical.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Explain the main responsibility of AWS Key Management Service.
- Choose a workload that fits AWS Key Management Service.
- Identify one operational tradeoff of AWS Key Management Service.
- Compare AWS Key Management Service with Azure Key Vault Keys.
- Compare AWS Key Management Service with Google Cloud Key Management Service.
Documentation and sources
- AWS cloud services catalog (aws.amazon.com)
Connect the ideas
Alternatives
Explore next
Real World Example
Securing Multi-Tenant Financial Records with AWS KMS
A boutique financial advisory firm managing sensitive client investment portfolios across shared cloud infrastructure.
The business problem
The firm faces a compliance risk where unauthorized internal applications or compromised service roles could potentially access raw client data stored in shared storage buckets.
How this topic solves it
The firm implements AWS Key Management Service to enforce envelope encryption, ensuring that data is only accessible to services that possess explicit IAM permissions to call the KMS Decrypt API for specific Customer Master Keys.
- Create a Customer Managed Key within AWS KMS to serve as the root of trust for financial data.
- Define a Key Policy that restricts usage to specific IAM roles associated with the firm's application tier.
- Configure the application to request a data key from KMS to encrypt objects before uploading them to storage.
- Attach IAM policies to application roles that grant kms:Decrypt permissions only for the specific key ARN.
This diagram illustrates the interaction between the application, KMS, and storage.
Generates and decrypts keys
Holds encrypted data
Controls access rights
- Application → requests key → AWS KMS
- AWS KMS → returns ciphertext → Application
- Application → writes ciphertext → Storage
- IAM Policy → authorizes access → AWS KMS
Expected business outcome
The firm achieves cryptographic isolation between tenants, ensuring that even if storage access is misconfigured, the underlying data remains ciphertext without the corresponding KMS key access.
Limitations and checks
A critical limitation is the strict regionality of KMS keys; keys cannot be used across different AWS regions, requiring a multi-region replication strategy or separate key management per region, which can be verified by checking the Key ARN region prefix.