AWS KMS: Key Management Service
By the end of this lesson, you'll be able to:
- Explain what AWS KMS manages and why encryption needs a managed key service
- Describe how KMS keys relate to the encryption-at-rest concept from an earlier lesson
- Explain why access to a KMS key should follow the same least-privilege discipline as any other AWS permission
Prerequisites: "Secrets Management with AWS Secrets Manager"
Encryption needs keys — and keys need managing
The previous encryption lesson introduced encryption at rest conceptually, without going into how the underlying cryptographic keys are actually managed. AWS KMS (Key Management Service) is the answer: a managed service for creating, storing, and controlling access to the cryptographic keys other AWS services use to perform encryption.
Rather than every team building and operating their own key management infrastructure — a genuinely hard problem to get right — services like S3, RDS, and EBS integrate with KMS directly, so enabling encryption at rest for a resource commonly means selecting a KMS key for it, rather than managing raw key material yourself.
A KMS key is itself a protected resource
This is worth stating clearly: a KMS key is not a passive setting — it's a real AWS resource, and permission to use it (to encrypt or decrypt data with it) or manage it (to change its configuration) is controlled through IAM, exactly like every other AWS permission this course has covered. Granting broad, unnecessary access to a KMS key defeats much of the point of encrypting the data it protects in the first place — the same least-privilege discipline Module 2 taught for every other AWS permission applies here without exception: grant only the specific identities that genuinely need to use a specific key, nothing wider.
This lesson stays conceptual on purpose
KMS has real depth — key rotation, key policies, multi-Region keys, and more — that goes beyond what a beginner-level module needs to cover. The durable takeaway here is the relationship: KMS manages the keys; other services use those keys to actually encrypt and decrypt data; and access to a key is an IAM-controlled permission like any other, worth granting narrowly and reviewing periodically rather than broadly and forgetting about.
Exercise
A team enables encryption at rest on an RDS database using a KMS key, then grants every developer on the team full permission to manage that key "just in case someone needs it later." Using this lesson's reasoning, explain what's wrong with that decision, and what a better-scoped alternative would look like.
Show hint
Think about the specific identities that actually need to use or manage the key, versus everyone on the team by default.
AWS KMS: Key Management Service Quiz
My Notes
Log in to keep private notes on this lesson.
Questions about this lesson
No questions yet — be the first to ask.
Log in to ask a question about this lesson.
Summary
AWS KMS (Key Management Service) creates and manages the cryptographic keys that other AWS services, such as S3 or RDS, use to perform encryption at rest — access to a key is itself an IAM-controlled permission, so the same least-privilege discipline this course has applied everywhere else applies directly to who can use or manage a KMS key.