Security, Identity, and Compliance
AWS Key Management Service (AWS KMS)
A managed service for creating and controlling encryption keys used to protect data in AWS services and applications.
Key points
- KMS keys protect data at rest through integrations with many AWS services.
- Key policies and IAM permissions control use and administration of keys.
- KMS manages cryptographic keys; it is not a general password vault.
Best-known use cases
- Control encryption keys for supported AWS resources.
- Centralize permissions and auditing for key use.
What candidates often confuse it with
- KMS manages encryption keys; Secrets Manager stores and can rotate secret values such as passwords and API keys.
- Encryption at rest protects stored data; TLS commonly protects data in transit.
Key takeaway
Choose KMS when the requirement centers on controlling encryption keys.
Related services
- AWS Secrets Manager
- AWS CloudTrail
Relevant exam tasks
- D2.2 — Understand AWS Cloud security, governance, and compliance concepts.
- D2.3 — Identify AWS access management capabilities.