AWS Key Management Service
AWS Key Management Service (KMS) creates and manages cryptographic keys for encrypting data and digitally signing it.
What AWS Key Management Service is
AWS Key Management Service (KMS) creates and manages cryptographic keys for encrypting data and digitally signing it. It lets teams control key lifecycles and permissions separately, including who administers keys and who uses them. KMS supports symmetric encryption, asymmetric signing or encryption, and HMAC generation and verification. It integrates with AWS services such as Amazon S3, EBS, RDS, DynamoDB, Lambda, and CloudTrail; with CloudTrail enabled, requests can be recorded with the user, time, API action, and key. KMS uses hardware security modules validated to FIPS 140-3 Security Level 3, and AWS says plaintext keys are not written to disk. Multi-Region keys can support cross-Region workflows, while external key stores let customers keep key material in an external manager they own. The service scales with demand, subject to default key and request limits. It is cloud-based, with a listed price of $1 a month per KMS key, prorated hourly; API requests are charged separately, and a 20,000-request monthly free tier applies across Regions with exclusions.
Good
- Supports symmetric and asymmetric cryptographic operations.
- Integrates with several AWS services.
- CloudTrail can record KMS request details.
- Hardware security modules protect key material.
- Automatic key rotation and key import are supported.
Watch out
- API requests are charged separately.
- Default key-count and request-rate limits apply.
- Custom key stores lack support in two China Regions.
- Custom key stores do not support asymmetric KMS keys.
Who it suits
KMS suits teams that need centralized key controls for AWS workloads, including separate permissions for key administrators and users. It also supports customers managing external key stores or cross-Region workflows.
Verdict
AWS KMS provides centralized key management with integrations, audit logging, and HSM-backed protection. Review request charges, default limits, and custom key store restrictions against your requirements.
Plans and prices
From AWS Key Management Service's own pricing page, checked 29 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| AWS KMS | $1 a month | 20,000 requests/month free tier across Regions; asymmetric-key requests and specified key-pair operations are excluded · $1/month (prorated hourly) per KMS key; API requests are charged separately |
The facts
Each one read from AWS Key Management Service's own pages, with the date it was checked.
Where it runs
- Application libraries
- The AWS Encryption SDK supports KMS as a key provider for encrypting and decrypting data locally in applications.checked 29 Sep 2026
What it does
- Auditing
- When CloudTrail is enabled, KMS requests are recorded with details such as the user, time, API action, and key used.checked 29 Sep 2026
- Compliance
- AWS lists KMS validations or certifications including SOC 1, SOC 2, SOC 3, PCI DSS Level 1, FedRAMP, HIPAA, and FIPS 140-3.checked 29 Sep 2026
- Cryptographic operations
- KMS supports symmetric encryption, asymmetric signing or encryption key pairs, and generation and verification of HMACs.checked 29 Sep 2026
- Custom key store limits
- Custom key stores are unavailable in the AWS China (Beijing) and AWS China (Ningxia) Regions and do not support asymmetric KMS keys.checked 29 Sep 2026
- External key stores
- With an external key store, keys are generated and stored in an external key manager that the customer owns and manages, and key material stays in that HSM.checked 29 Sep 2026
- Integrations
- KMS integrates with AWS services including Amazon S3, Amazon EBS, Amazon RDS, Amazon DynamoDB, AWS Lambda, and AWS CloudTrail.checked 29 Sep 2026
- Key management
- KMS provides centralized control over key lifecycles and permissions, including separate control over who manages keys and who uses them.checked 29 Sep 2026
- Key protection
- KMS uses hardware security modules validated to FIPS 140-3 Security Level 3 to protect key material and cryptographic operations.checked 29 Sep 2026
- Multi-Region keys
- Multi-Region keys share key material and key IDs across Regions and can support cross-Region workflows such as disaster recovery.checked 29 Sep 2026
- Plaintext keys
- AWS states that plaintext keys are never written to disk and are used only in HSM volatile memory for the requested cryptographic operation.checked 29 Sep 2026
- Post-quantum support
- KMS supports post-quantum TLS using ML-KEM and post-quantum signatures using ML-DSA.checked 29 Sep 2026
- Pricing exclusions
- AWS-managed and AWS-owned key creation and storage are not charged, but API requests to AWS-managed keys are chargeable.checked 29 Sep 2026
- Purpose
- AWS KMS creates and controls cryptographic keys used to encrypt data and digitally sign it.checked 29 Sep 2026
- Scaling and limits
- KMS automatically scales as encryption needs grow, has default limits for key counts and request rates, and allows customers to request higher limits.checked 29 Sep 2026
Alternatives to AWS Key Management Service
- 1
Google Cloud Secret Manager
Free planWeb6.5From $0.02 a month - 2
Utimaco Enterprise Secure Key Manager
WebAPILinuxSelf-hosted6.5 - 3
OpenStack Barbican
Free planAPILinuxSelf-hosted6.1Free plan - 4
Cryptsoft KMIP Server
WebAPILinuxSelf-hosted6.0 - 5
Kleopatra
Free planLinuxWindows6.0Free plan - 6
Fornetix Key Orchestration Platform
WebAPILinuxSelf-hosted5.9