Key points

• Key policies, IAM policies, and grants participate in authorized key use.
• Envelope encryption protects data keys with KMS keys.
• Rotation retains key material needed to decrypt existing ciphertext and does not rotate stored application credentials.

Best-known use cases

• Control application encrypt/decrypt or data-key operations.
• Authorize supported encryption across account boundaries.

What candidates often confuse it with

• KMS rotates cryptographic key material; Secrets Manager rotates secret values and target credentials.
• Client-side encryption transforms plaintext in the application; server-side encryption occurs in the receiving service.

Key takeaway

Use KMS for controlled cryptographic key operations and authorize both key and principal sides of cross-account use.

Related services

• AWS Secrets Manager
• Amazon S3
• AWS Identity and Access Management (IAM)

Relevant exam tasks

• D2.2 — Implement encryption by using AWS services
• 2.2.3 — Describe differences between client-side encryption and server-side encryption
• 2.2.4 — Use encryption keys to encrypt or decrypt data
• 2.2.6 — Use encryption across account boundaries
• 2.2.7 — Enable and disable key rotation
• D2.3 — Manage sensitive data in application code
• 2.3.2 — Encrypt environment variables that contain sensitive data

Learn more

• AWS Key Management Service (AWS KMS)