AWS Key Management Service features

AWS Key Management Service (KMS) gives you centralized control over the cryptographic keys used to protect your data. The service is integrated with other AWS services making it easier to encrypt data you store in these services and control access to the keys that decrypt it. AWS KMS is also integrated with AWS CloudTrail, which helps you audit who used which keys, on which resources, and when. AWS KMS helps developers to more easily add encryption or digital signature functionality to their application code either directly or by using the AWS SDK. The AWS Encryption SDK supports AWS KMS as a key provider for developers who need to encrypt/decrypt data locally within their applications.

AWS KMS provides you with centralized control over the lifecycle and permissions of your keys. You can create new keys whenever you want, and you can control who can manage keys separately from who can use them. As an alternative to using keys generated by AWS KMS, you can import keys from your own key management infrastructure, use keys stored in your AWS CloudHSM cluster or keys kept outside AWS in your external key manager. You can choose automatic rotation of root keys generated in AWS KMS once per year without the need to re-encrypt previously encrypted data. The service automatically keeps older versions of the root key available to decrypt previously encrypted data. You can manage your root keys and audit their usage from the AWS Management Console or by using the AWS SDK or AWS Command Line Interface (CLI).

* The option to import keys is not available for asymmetric keys.

AWS KMS integrates with AWS services to encrypt data at rest, or to facilitate signing and verification using an AWS KMS key. To protect data at rest, integrated AWS services use envelope encryption, where a data key is used to encrypt data and is itself encrypted under a KMS key stored in AWS KMS. For signing and verification, integrated AWS services use asymmetric RSA or ECC KMS keys in AWS KMS. For more details about how an integrated service uses AWS KMS, see the documentation for your AWS service.

[1] Supports only AWS managed keys.

[2] AWS KMS supports custom key stores backed by an AWS CloudHSM cluster.

[3] For a list of services integrated with AWS KMS in the AWS China (Beijing) Region, operated by Sinnet and the AWS China (Ningxia) Region, operated by NWCD, please visit AWS KMS Service integration in China.

AWS services not listed above encrypt customer data using keys owned and managed by the respective service.

If you have AWS CloudTrail enabled for your AWS account, each request you make to AWS KMS is recorded in a log file. This log file is delivered to the Amazon Simple Storage Service (Amazon S3) bucket that you specified when you enabled AWS CloudTrail. The information recorded includes details of the user, time, date, API action, and the key used, when relevant.

AWS KMS is a fully managed service. As your use of encryption grows, the service automatically scales to meet your needs. It helps you manage tens of thousands of KMS keys in your account and to use them whenever you want. It defines default limits for number of keys and request rates, but you can request increased limits if necessary.

The KMS keys you create or ones that are created on your behalf by other AWS services cannot be exported from the service. Therefore, AWS KMS takes responsibility for their durability. To help verify that your keys and your data are highly available, AWS KMS stores multiple copies of encrypted versions of your keys in systems that are designed for 99.999999999% durability.

For encrypted data or digital signature workflows that move across Regions (disaster recovery, multi-Region high availability architectures, DynamoDB Global Tables, and globally distributed consistent digital signatures), you can create KMS multi-Region keys. KMS multi-Region keys are a set of interoperable keys with the same key material and key IDs that can be replicated into multiple Regions.

AWS KMS is designed to be a highly available service with a Regional API endpoint. As most AWS services rely on it for encryption and decryption, AWS KMS is architected to provide a level of availability. This availability supports the rest of AWS and is backed by the AWS KMS Service Level Agreement.

AWS KMS is designed so that no one, including AWS employees, can retrieve your plaintext keys from the service. The service uses hardware security modules (HSMs) that have been validated under FIPS 140-2, or are in the process of being validated, to protect the confidentiality and integrity of your keys. Your plaintext keys are never written to disk and only ever used in volatile memory of the HSMs for the time needed to perform your requested cryptographic operation. This is true regardless of whether you request AWS KMS to create keys on your behalf, import them into the service, or create them in an AWS CloudHSM cluster using the custom key store feature. Keys created by the service AWS KMS are never transmitted outside of the AWS Region in which they were created. They can be used in only the Region in which they were created. Updates to the AWS KMS HSM firmware are controlled by a multi-party access control that is audited and reviewed by an independent group within Amazon and a NIST accredited lab in compliance with FIPS 140-2.

To learn more about how AWS KMS is architected and the cryptography it uses to secure your keys, read more about the AWS KMS cryptographic details.

* In the AWS China (Beijing) Region, operated by Sinnet and the AWS China (Ningxia) Region, operated by NWCD, the HSMs are Chinese government approved (not FIPS 140-2 validated), and the Cryptographic Details Whitepaper mentioned above does not apply.  

AWS KMS helps you create and use asymmetric KMS keys and data key pairs. You can designate a KMS key for use as a signing key pair or an encryption key pair. Key pair generation and asymmetric cryptographic operations using these KMS keys are performed inside HSMs. You can request the public portion of the asymmetric KMS key for use in your local applications, while the private portion never leaves the service.

You can also request the service to generate an asymmetric data key pair. This operation returns a plaintext copy of the public key, private key, and a copy of the private key encrypted under a symmetric KMS key that you specify. You can use the plaintext public or private key in your local application and store the encrypted copy of the private key for future use.

* Asymmetric keys are not supported with custom key stores.

You can generate and verify Hash-Based Message Authentication Code (HMACs) from within AWS KMS’s FIPS 140-2 validated hardware security modules (HSMs). HMACs are a cryptographic building block that incorporate secret key material within a hash function to create a unique keyed message authentication code. HMAC KMS keys provide an advantage over HMACs from application software because the key material is generated and used entirely within AWS KMS. They are also subject to the access controls that you set on the key. The HMAC KMS keys and the HMAC algorithms that AWS KMS uses conform to industry standards defined in RFC 2104. HMAC KMS keys are generated in AWS KMS hardware security modules that are certified under the FIPS 140-2 Cryptographic Module Validation Program (except in China [Beijing] and China [Ningxia] Regions) and never leave AWS KMS unencrypted.

*AWS KMS HMAC keys are not supported in custom key stores.

Security and quality controls in AWS KMS have been validated and certified by the following compliance regimes:

• AWS Service Organization Controls (SOC 1, SOC 2, and SOC 3) reports. You can download a copy of the reports from AWS Artifact.
  
• PCI DSS Level 1. Learn more about PCI DSS compliant services in AWS at PCI DSS FAQs.
  
• FIPS 140-2. The AWS KMS cryptographic module is validated, or in the process of being validated, at FIPS 140-2 Level 2 overall with Level 3 for several other categories, including physical security. Learn more by viewing the FIPS 140-2 certificate for AWS KMS HSM along with the associated Security Policy.
  
• FedRAMP. Learn more about AWS FedRAMP compliance at FedRAMP Compliance.
  
• HIPAA. For more at the HIPAA Compliance page.