What KMS Keys Are and Do
Understand customer managed, AWS managed, and owned keys.
What KMS Keys Are and Do is a free AWS Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the AWS Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
The Need for Managed Keys
Encryption is only as strong as how you protect the keys. Storing keys in code or files is risky and hard to audit.
AWS KMS (Key Management Service) creates, stores, and controls encryption keys in hardware security modules, and ties every use to IAM permissions and audit logs.
What a KMS Key Is
A KMS key (formerly called a CMK, customer master key) is a logical representation of a cryptographic key inside KMS.
- The key material never leaves KMS unencrypted.
- You ask KMS to encrypt or decrypt; the raw key is not exposed to you.
This is the foundation of AWS encryption.
Customer Managed Keys
Customer managed keys are KMS keys you create and fully control.
- You set the key policy, enable or disable, and schedule deletion.
- You control rotation and grants.
They cost a small monthly fee plus per-request charges and offer the most control.
AWS Managed Keys
AWS managed keys are created on your behalf by an AWS service, named like aws/s3.
- AWS manages their policy and rotation.
- You cannot change their key policy or delete them directly.
They are convenient but offer less control than customer managed keys.
AWS Owned Keys
AWS owned keys are a shared pool that AWS uses across many accounts.
They are invisible in your account, free, and fully managed by AWS. You cannot view, audit, or control them, so they suit cases where you do not need key visibility.
Encrypt and Decrypt Operations
You interact with KMS through API calls like Encrypt, Decrypt, and GenerateDataKey.
KMS performs the cryptography server-side and returns the result. Direct encryption is limited to small data (up to about 4 KB); larger data uses data keys, covered later.
aws kms encrypt \
--key-id alias/my-app-key \
--plaintext fileb://secret.txt \
--output textCloudTrail Integration
Every KMS API call is recorded in CloudTrail.
You get a full audit trail of who used which key, when, and for what operation. This makes KMS both a control point and an accountability mechanism, key for incident investigations.
Aliases
An alias is a friendly name pointing to a KMS key, like alias/prod-db.
- Applications reference the alias, not the key ID.
- You can repoint an alias to a new key without changing app code.
Aliases simplify rotation and management.
Key States
A KMS key moves through states: enabled, disabled, pending deletion, and (for imported material) pending import.
Disabling a key blocks its use without deleting it. Deletion is scheduled with a waiting period (7 to 30 days) so you can cancel if data is still needed, because deletion is irreversible.
Where KMS Fits
KMS is the central key authority behind nearly all AWS encryption: S3, EBS, RDS, Secrets Manager, and more call KMS under the hood.
Understanding key types and control is essential because exam questions hinge on who manages and can use a given key.
Choosing a Key Type
Pick by control needs:
- Customer managed when you need full control, custom policy, or auditing of rotation.
- AWS managed for convenient service encryption.
- AWS owned when you do not need visibility at all.
Quick Check
Distinguish key types.
Recap
You learned what KMS keys are.
- Key material stays inside KMS; you call Encrypt/Decrypt.
- Customer managed keys give full control; AWS managed are service-created; AWS owned are invisible.
- Aliases, key states, and CloudTrail support safe management.
Frequently asked questions
Is the “What KMS Keys Are and Do” lesson free?
Yes — the full text of “What KMS Keys Are and Do” is free to read here on the web, and the AWS Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the AWS Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “What KMS Keys Are and Do”?
Understand customer managed, AWS managed, and owned keys. You practise AWS Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start AWS Security Academy?
No prior experience is required. AWS Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “What KMS Keys Are and Do” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this AWS Security Academy lesson?
Yes. Every AWS Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.