Security, Identity, and Compliance
CoreAWS KMS
Managed creation and control of encryption keys integrated with AWS services and applications.
Key points
- Customer managed KMS keys provide customer policy, grants, lifecycle, and cross-account control; that control adds administration.
- Key policies are part of the authorization boundary, and service/caller permissions must align.
- KMS commonly supports envelope encryption and auditability without requiring customers to operate HSM clusters.
Best-known use cases
- Encrypt S3, EBS, RDS, backups, and application data with controlled keys.
- Separate key administrators from data users.
What candidates often confuse it with
- KMS is a managed key service; CloudHSM provides dedicated HSMs with direct customer administration.
- KMS manages encryption keys; ACM manages TLS certificates.
Key takeaway
Choose KMS for managed encryption integration; use a customer managed key only when its extra control is required.
Related services
- AWS CloudHSM
- AWS Certificate Manager (ACM)
- AWS Backup
Relevant exam tasks
- D1.3