Security, Identity, and Compliance
CoreAWS KMS
Managed keys and authorization for encryption, decryption, and cross-account use.
Key points
- KMS controls cryptographic keys used by data stores and pipeline artifacts.
- Cross-account use requires key-side authorization and matching permission for the external principal.
Best-known use cases
- Control encryption keys for data stores and pipeline artifacts.
- Authorize cross-account decryption of shared encrypted datasets.
What candidates often confuse it with
- KMS governs keys and cryptographic authorization; Secrets Manager stores and rotates credential values.
Key takeaway
Choose KMS when the design must control encryption keys, key policy, or cross-account decryption.
Relevant exam tasks
- D4.3 — Task 4.3: Ensure data encryption and masking
- 4.3.2 — Use encryption keys to encrypt or decrypt data (for example, AWS KMS).
- 4.3.3 — Configure encryption across AWS account boundaries.
- 4.3.4 — Enable encryption in transit or before transit for data.