AWS Key Management Service (KMS)
#94 · Level 3 · Modern architecture · SecurityConcept
Section titled “Concept”AWS KMS (Key Management Service) creates encryption keys, stores them safely and controls how they are used. Keys are protected inside KMS in hardware security modules, and the main key usually never leaves. Key policies and IAM decide who can encrypt or decrypt with which key. Every use of a key is recorded in CloudTrail. Many AWS services, such as S3, EBS and RDS, use KMS behind the scenes to encrypt data.
Simple example
Section titled “Simple example”Key management for bank lockers — the keys stay in the bank’s vault, and who used them and when is written down.
Why it’s needed
Section titled “Why it’s needed”Encrypting data is no use if the key is left unprotected. The key needs to be kept safe, and you need to decide who can use it.
Where it’s used
Section titled “Where it’s used”Encrypting data in S3, EBS and RDS — most AWS services use KMS behind the scenes.
Azure equivalent
Section titled “Azure equivalent”Azure Key Vault (keys)
Learn more
Section titled “Learn more”For details and the latest information, see the official documentation: