Security
AWS Key Management Service (KMS)
Creates and controls cryptographic keys for encryption.
Key points
- Creates and manages cryptographic keys used by AWS services and applications.
- Supports customer managed keys when teams need control over key policies and rotation settings.
- Integrates with many AWS services for encryption at rest.
- Uses IAM and key policies to control who can use or administer keys.
- Provides audit visibility through CloudTrail for key usage events.
When to use it
- Choose KMS when data at rest needs encryption with managed key control.
- Use customer managed keys when access, rotation, or separation of duties must be controlled by the customer.
- Use it for encrypting storage, logs, datasets, model artifacts, or other sensitive AI workload data.
Exam tips
- KMS protects encryption keys; IAM controls identities and permissions.
- Encryption at rest uses KMS in many services, while TLS protects data in transit.
- Key policies can matter even when IAM permissions look correct.
- KMS does not anonymize or redact data; use data minimization, masking, or service-specific filters for privacy.