AWS Key Management Service
Create and control keys used to encrypt or digitally sign your data
Start with 20,000 free requests
per month with the AWS Free Tier
Centrally manage keys and define policies across integrated services and applications from a single point.
Encrypt data within your applications with the AWS Encryption SDK data encryption library.
Perform signing operations using asymmetric key pairs to validate digital signatures.
Securely generate hash-based message authentication codes (HMACs) that ensure message integrity and authenticity.
How it works
The diagram shows the key features of AWS Key Management Service and the integrations available with other AWS services. Three sections display.
The first section has the title “AWS KMS,” with an illustration of the AWS KMS architectural icon, and the text “Create and control the cryptographic keys that protect your data.” A box appears to the right titled “Create a KMS key” with text “Your KMS keys never leave our FIPS 140-validated HSMs unencrypted, and you control who can access and use them.” To the right is another heading "Cryptographic operations,” with explanatory text that reads, "Use your KMS keys in cryptographic operations." This first section additionally lists the key AWS KMS features. These features are: "Encrypt and decrypt data," "Sign and verify," "Generate and export data keys," and "Generate and verify MACs."
Below the first section is a title “KMS key monitoring"," with explanatory text that reads, "Automate monitoring to receive event alerts and audit who used which keys, on which resources, and when." There are two services listed, AWS CloudTrail and Amazon CloudWatch, with the respective architectural icons.
To the right of these two sections is the third, and final section. The title is “AWS KMS integrated services” with accompanying text “AWS services perform envelope encryption using data keys protected by your KMS keys to encrypt data at rest.” The services listed are: Amazon EC2, Amazon S3, Amazon EBS, and other AWS services.
Use AWS KMS to encrypt data across your AWS workloads, digitally sign data, encrypt within your applications using AWS Encryption SDK, and generate and verify message authentication codes (MACs).
To watch in your local language, select this video, choose the settings icon, and pick your preferred subtitle option.
Use AWS KMS to encrypt data across your AWS workloads, digitally sign data, encrypt within your applications using AWS Encryption SDK, and generate and verify message authentication codes (MACs).
To watch in your local language, select this video, choose the settings icon, and pick your preferred subtitle option.
Use cases
Protect your data at rest
Activate server-side encryption with AWS KMS using KMS keys that you control and manage.
Learn more about AWS service integration »
Encrypt and decrypt data
Use the AWS Encryption SDK to securely handle cryptographic operations in your applications.
Sign and verify digital signatures
Protect signing operations with AWS KMS using asymmetric KMS keys.
Build secure multi-tenant databases
Use the AWS Database Encryption SDK to easily encrypt and securely search sensitive records in your databases.