Security, Identity, and Compliance
AWS Key Management Service (AWS KMS)
A managed service for creating and controlling encryption keys used to protect data in AWS services and applications.
Key points
- KMS keys protect data at rest through integrations with many AWS services.
- Key policies and IAM permissions control use and administration of keys.
- KMS manages cryptographic keys; it is not a general password vault.
Best-known use cases
- Control encryption keys for supported AWS resources.
- Centralize permissions and auditing for key use.
What candidates often confuse it with
- KMS manages encryption keys; Secrets Manager stores and can rotate secret values such as passwords and API keys.
- Encryption at rest protects stored data; TLS commonly protects data in transit.
Key Cloud Practitioner takeaway
Choose KMS when the requirement centers on controlling encryption keys.
Related services
- AWS Secrets Manager
- AWS CloudTrail
Relevant exam tasks
- D2.2
- D2.3