Security, Identity, and Compliance
AWS Key Management Service (KMS)
AWS Key Management Service (KMS) creates and controls cryptographic keys used by AWS services and applications. Customer-managed keys give GenAI teams policy, rotation, audit, and separation-of-duties control over protected data.
Key points
- Key policies are a primary authorization boundary alongside IAM
- Envelope encryption lets services protect large data with data keys
- Grants provide scoped delegated use for many service integrations
When to use it
- Encrypt a knowledge-base S3 bucket and vector store with a controlled key
- Separate tenant or environment cryptographic boundaries for sensitive artifacts
Exam tips
- Choose KMS for managed keys and the Encryption SDK when application-side envelope encryption is required
- Grant both the workload and integrating service the exact key operations; S3 permission alone is insufficient