Freedom251 › Key Management Software
AWS Key Management Service
What AWS Key Management Service is
AWS Key Management Service (KMS) creates and controls cryptographic keys for encrypting data and digitally signing it. It centralizes key lifecycles and permissions, including distinct control over who manages keys and who uses them. KMS supports symmetric encryption, asymmetric signing or encryption key pairs, and HMAC generation and verification. It integrates with AWS services including Amazon S3, Amazon EBS, Amazon RDS, Amazon DynamoDB, AWS Lambda, and AWS CloudTrail. With CloudTrail enabled, requests are logged with details such as the user, time, API action, and key. AWS says hardware security modules validated to FIPS 140-3 Security Level 3 protect key material and operations; plaintext keys are not written to disk and are used only in HSM volatile memory for the requested operation. Multi-Region keys support cross-Region workflows, while external key stores keep key material in an external manager controlled by the customer. The service scales with demand, subject to default key-count and request-rate limits; higher limits can be requested. The listed price is $1 a month per KMS key, prorated hourly. API requests are charged separately, with a 20,000-request monthly free tier across Regions subject to exclusions.
Who it suits
KMS suits organizations using AWS services that need centralized key lifecycle and permission control. It also supports customers who need multi-Region workflows or want key material kept in an external key manager.
What it does well
- Supports symmetric, asymmetric, and HMAC operations.
- Integrates with several AWS services.
- CloudTrail can record key requests and related details.
- Uses HSMs validated to FIPS 140-3 Security Level 3.
What to know first
- API requests are charged separately from key costs.
- Custom key stores are unavailable in two AWS China Regions.
- Custom key stores do not support asymmetric KMS keys.
- Default key and request limits apply.
Limits
The plan lists 20,000 API requests per month free across Regions; asymmetric-key requests and specified key-pair operations are excluded. API requests are charged separately, and KMS has default key-count and request-rate limits, with higher limits available by request.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| AWS KMS | $1/month (prorated hourly) per KMS key; API requests are charged separately · 20,000 requests/month free tier across Regions; asymmetric-key requests and specified key-pair operations are excluded | $1 a month |
As aws.amazon.com lists them, read 29 Sept 2026. The maker's own page has the final word.
Getting started
- Open the AWS KMS website.
- Use the web interface or API.
- Choose a KMS key and manage its lifecycle and permissions.
- Connect KMS with an AWS service or use the AWS Encryption SDK in an application.
Verdict
AWS KMS combines centralized key controls with multiple cryptographic operations and AWS service integrations. Account for per-key charges, separately billed API requests, and default limits when planning usage.
Questions
How much does AWS KMS cost?
The listed plan is $1 a month per KMS key, prorated hourly. API requests are charged separately.
Is there a free plan?
Yes. The plan includes 20,000 requests per month free across Regions, with exclusions for asymmetric-key requests and specified key-pair operations. AWS-managed and AWS-owned key creation and storage are not charged.
Which platforms does it support?
AWS KMS is available through web and API, and its deployment model is cloud.
Which key types does KMS support?
It supports symmetric encryption, asymmetric signing or encryption key pairs, and HMAC generation and verification.
Can KMS keep keys outside AWS?
An external key store uses an external key manager owned and managed by the customer, with key material remaining in that manager's HSM. Custom key stores do not support asymmetric KMS keys and are unavailable in the AWS China Regions.
Which AWS services integrate with KMS?
Listed integrations include Amazon S3, Amazon EBS, Amazon RDS, Amazon DynamoDB, AWS Lambda, and AWS CloudTrail.
Facts from AWS Key Management Service's own pages
- Application libraries
- The AWS Encryption SDK supports KMS as a key provider for encrypting and decrypting data locally in applications. · aws.amazon.com, 29 Sept 2026
- Auditing
- When CloudTrail is enabled, KMS requests are recorded with details such as the user, time, API action, and key used. · aws.amazon.com, 29 Sept 2026
- Compliance
- AWS lists KMS validations or certifications including SOC 1, SOC 2, SOC 3, PCI DSS Level 1, FedRAMP, HIPAA, and FIPS 140-3. · aws.amazon.com, 29 Sept 2026
- Cryptographic operations
- KMS supports symmetric encryption, asymmetric signing or encryption key pairs, and generation and verification of HMACs. · aws.amazon.com, 29 Sept 2026
- Custom key store limits
- Custom key stores are unavailable in the AWS China (Beijing) and AWS China (Ningxia) Regions and do not support asymmetric KMS keys. · aws.amazon.com, 29 Sept 2026
- External key stores
- With an external key store, keys are generated and stored in an external key manager that the customer owns and manages, and key material stays in that HSM. · aws.amazon.com, 29 Sept 2026
- Integrations
- KMS integrates with AWS services including Amazon S3, Amazon EBS, Amazon RDS, Amazon DynamoDB, AWS Lambda, and AWS CloudTrail. · aws.amazon.com, 29 Sept 2026
- Key management
- KMS provides centralized control over key lifecycles and permissions, including separate control over who manages keys and who uses them. · aws.amazon.com, 29 Sept 2026
- Key protection
- KMS uses hardware security modules validated to FIPS 140-3 Security Level 3 to protect key material and cryptographic operations. · aws.amazon.com, 29 Sept 2026
- Multi-Region keys
- Multi-Region keys share key material and key IDs across Regions and can support cross-Region workflows such as disaster recovery. · aws.amazon.com, 29 Sept 2026
- Plaintext keys
- AWS states that plaintext keys are never written to disk and are used only in HSM volatile memory for the requested cryptographic operation. · aws.amazon.com, 29 Sept 2026
- Post-quantum support
- KMS supports post-quantum TLS using ML-KEM and post-quantum signatures using ML-DSA. · aws.amazon.com, 29 Sept 2026
- Pricing exclusions
- AWS-managed and AWS-owned key creation and storage are not charged, but API requests to AWS-managed keys are chargeable. · aws.amazon.com, 29 Sept 2026
- Purpose
- AWS KMS creates and controls cryptographic keys used to encrypt data and digitally sign it. · aws.amazon.com, 29 Sept 2026
- Scaling and limits
- KMS automatically scales as encryption needs grow, has default limits for key counts and request rates, and allows customers to request higher limits. · aws.amazon.com, 29 Sept 2026
Where AWS Key Management Service stands on Freedom251
- Key Management Software#1 of 25
- Encryption Key Management Software#1 of 24