Skip to content
SPECIFICTION
Get listed

AWS Key Management Service

aws.amazon.com

From $1/mo WebAPI
Visit aws.amazon.com
Spec score 8.0 #2 of 25 in Key Management Software

What it is

AWS Key Management Service creates and controls cryptographic keys for data encryption and digital signatures. It centralizes key lifecycles and permissions, including separate control over administrators and key users. KMS supports symmetric encryption, asymmetric signing or encryption pairs, and HMAC generation and verification. The AWS Encryption SDK can use KMS as a key provider for local application encryption and decryption. Integrations include Amazon S3, EBS, RDS, DynamoDB, Lambda, and CloudTrail. With CloudTrail enabled, requests can record the user, time, API action, and key. AWS says hardware security modules validated to FIPS 140-3 Security Level 3 protect key material and operations, with plaintext keys kept only in volatile HSM memory. Multi-Region keys support cross-Region workflows; external key stores keep material in a customer-managed external manager. KMS scales with demand but has default key and request limits. The listed plan is $1 a month per KMS key, prorated hourly.

Spec sheet

Purpose
AWS KMS creates and controls cryptographic keys used to encrypt data and digitally sign it.Read 29 Sep 2026 · aws.amazon.com
Integrations
KMS integrates with AWS services including Amazon S3, Amazon EBS, Amazon RDS, Amazon DynamoDB, AWS Lambda, and AWS CloudTrail.Read 29 Sep 2026 · aws.amazon.com
Compliance
AWS lists KMS validations or certifications including SOC 1, SOC 2, SOC 3, PCI DSS Level 1, FedRAMP, HIPAA, and FIPS 140-3.Read 29 Sep 2026 · aws.amazon.com
Application libraries
The AWS Encryption SDK supports KMS as a key provider for encrypting and decrypting data locally in applications.Read 29 Sep 2026 · aws.amazon.com
Auditing
When CloudTrail is enabled, KMS requests are recorded with details such as the user, time, API action, and key used.Read 29 Sep 2026 · aws.amazon.com
Cryptographic operations
KMS supports symmetric encryption, asymmetric signing or encryption key pairs, and generation and verification of HMACs.Read 29 Sep 2026 · aws.amazon.com
Custom key store limits
Custom key stores are unavailable in the AWS China (Beijing) and AWS China (Ningxia) Regions and do not support asymmetric KMS keys.Read 29 Sep 2026 · aws.amazon.com
External key stores
With an external key store, keys are generated and stored in an external key manager that the customer owns and manages, and key material stays in that HSM.Read 29 Sep 2026 · aws.amazon.com
Key management
KMS provides centralized control over key lifecycles and permissions, including separate control over who manages keys and who uses them.Read 29 Sep 2026 · aws.amazon.com
Key protection
KMS uses hardware security modules validated to FIPS 140-3 Security Level 3 to protect key material and cryptographic operations.Read 29 Sep 2026 · aws.amazon.com
Multi-Region keys
Multi-Region keys share key material and key IDs across Regions and can support cross-Region workflows such as disaster recovery.Read 29 Sep 2026 · aws.amazon.com
Plaintext keys
AWS states that plaintext keys are never written to disk and are used only in HSM volatile memory for the requested cryptographic operation.Read 29 Sep 2026 · aws.amazon.com
Post-quantum support
KMS supports post-quantum TLS using ML-KEM and post-quantum signatures using ML-DSA.Read 29 Sep 2026 · aws.amazon.com
Pricing exclusions
AWS-managed and AWS-owned key creation and storage are not charged, but API requests to AWS-managed keys are chargeable.Read 29 Sep 2026 · aws.amazon.com
Scaling and limits
KMS automatically scales as encryption needs grow, has default limits for key counts and request rates, and allows customers to request higher limits.Read 29 Sep 2026 · aws.amazon.com

Plans and prices

AWS KMS $1 a month $1/month (prorated hourly) per KMS key; API requests are charged separately 20,000 requests/month free tier across Regions; asymmetric-key requests and specified key-pair operations are excluded Read 29 Sep 2026 · aws.amazon.com

Every AWS Key Management Service plan and price →

Strong points and limits

Strong points

  • Centralized lifecycle and permission controls
  • Symmetric, asymmetric, and HMAC operations
  • CloudTrail request auditing
  • FIPS 140-3 Level 3 HSM protection
  • Automatic key rotation and key import

Limits

  • API requests are charged separately
  • Default key and request limits apply
  • Custom key stores unavailable in two China Regions
  • Custom key stores do not support asymmetric keys

Who it suits

It suits organizations needing managed encryption keys, signing, auditing, and AWS-service integrations. It also fits teams requiring customer-managed keys, HSM protection, or cross-Region workflows.

Verdict

KMS combines managed key control, AWS integrations, audit records, and HSM-backed protection. Budget for the per-key charge and separate API-request pricing, while checking regional and key-store limits.

Where Specifiction places it

Alternatives to AWS Key Management ServiceAll alternatives →