Inferse
For vendors
AdvertiseTop spots, featured rows, home sponsor Get listedAdd a product we don't cover yet Claim a listingFree: verify the domain, then correct your page Vendor dashboardNumbers, orders and placements
List your platform
Vendor dashboard

AWS Key Management Service

APIyesOSS—FREE—DOCS5/5
AK6.9#4 of 16
outWeb—Windows—Mac—Linux—Android—iOS

Ranked in Key Management Software ·No free plan on record· paid from $1/mo

Visit site Alternatives

About

AWS Key Management Service (KMS) creates and controls cryptographic keys for encrypting data and digitally signing it. It provides centralized management of key lifecycles and permissions, with separate controls for people who manage keys and those who use them. KMS supports symmetric encryption, asymmetric signing or encryption, and HMAC generation and verification. Applications can use the AWS Encryption SDK to encrypt and decrypt data locally with KMS as the key provider. Integrations include Amazon S3, EBS, RDS, DynamoDB, Lambda, and CloudTrail; when CloudTrail is enabled, KMS requests can be recorded with the user, time, API action, and key. AWS says hardware security modules validated to FIPS 140-3 Security Level 3 protect key material, and plaintext keys are used only in HSM volatile memory for an operation. Multi-Region keys share material and IDs across Regions. The cloud service has a free plan and a listed starting price of $1/mo; key charges and API request charges are separate.

Who it is for

KMS suits teams building on AWS that need managed cryptographic keys, permission controls, and audit records. Its API and application-library support also fit teams incorporating encryption into software.

What is good

  • Separate permissions for managing and using keys
  • Supports symmetric, asymmetric, and HMAC operations
  • Integrates with S3, EBS, RDS, DynamoDB, Lambda
  • CloudTrail can record KMS request details
  • Multi-Region keys support cross-Region workflows

What to know first

  • API requests are charged separately
  • Custom key stores lack asymmetric key support
  • Custom key stores unavailable in two China Regions

Verdict

KMS combines key lifecycle controls, cryptographic operations, and AWS service integrations. Consider the separate API charges and the stated limits on custom key stores when choosing a key setup.

Compared on key management software

Free plan
Noaws.amazon.com
Paid from
$1/moaws.amazon.com
Deployment model
cloudaws.amazon.com
Key audit logs
Yesaws.amazon.com

Facts

Purpose
AWS KMS creates and controls cryptographic keys used to encrypt data and digitally sign it.aws.amazon.com · 29 Sept 2026
Key management
KMS provides centralized control over key lifecycles and permissions, including separate control over who manages keys and who uses them.aws.amazon.com · 29 Sept 2026
Cryptographic operations
KMS supports symmetric encryption, asymmetric signing or encryption key pairs, and generation and verification of HMACs.aws.amazon.com · 29 Sept 2026
Application libraries
The AWS Encryption SDK supports KMS as a key provider for encrypting and decrypting data locally in applications.aws.amazon.com · 29 Sept 2026
Integrations
KMS integrates with AWS services including Amazon S3, Amazon EBS, Amazon RDS, Amazon DynamoDB, AWS Lambda, and AWS CloudTrail.aws.amazon.com · 29 Sept 2026
Auditing
When CloudTrail is enabled, KMS requests are recorded with details such as the user, time, API action, and key used.aws.amazon.com · 29 Sept 2026
Key protection
KMS uses hardware security modules validated to FIPS 140-3 Security Level 3 to protect key material and cryptographic operations.aws.amazon.com · 29 Sept 2026
Plaintext keys
AWS states that plaintext keys are never written to disk and are used only in HSM volatile memory for the requested cryptographic operation.aws.amazon.com · 29 Sept 2026
Compliance
AWS lists KMS validations or certifications including SOC 1, SOC 2, SOC 3, PCI DSS Level 1, FedRAMP, HIPAA, and FIPS 140-3.aws.amazon.com · 29 Sept 2026
Multi-Region keys
Multi-Region keys share key material and key IDs across Regions and can support cross-Region workflows such as disaster recovery.aws.amazon.com · 29 Sept 2026
External key stores
With an external key store, keys are generated and stored in an external key manager that the customer owns and manages, and key material stays in that HSM.aws.amazon.com · 29 Sept 2026
Custom key store limits
Custom key stores are unavailable in the AWS China (Beijing) and AWS China (Ningxia) Regions and do not support asymmetric KMS keys.aws.amazon.com · 29 Sept 2026
Scaling and limits
KMS automatically scales as encryption needs grow, has default limits for key counts and request rates, and allows customers to request higher limits.aws.amazon.com · 29 Sept 2026
Pricing exclusions
AWS-managed and AWS-owned key creation and storage are not charged, but API requests to AWS-managed keys are chargeable.aws.amazon.com · 29 Sept 2026
Post-quantum support
KMS supports post-quantum TLS using ML-KEM and post-quantum signatures using ML-DSA.aws.amazon.com · 29 Sept 2026

Best AWS Key Management Service alternatives

See all 15
Thales CipherTrust Data Security Platform01 APIOSSFREEDOCS Free7.4Oracle Cloud Infrastructure Secret Management02 APIOSSFREEDOCS Free7.3OpenStack Barbican03 APIOSSFREEDOCS Free7.2Cryptsoft KMIP Server05 APIOSSFREEDOCS 6.9Entrust Certificate Manager06 APIOSSFREEDOCS 6.9Fornetix Key Orchestration Platform07 APIOSSFREEDOCS 6.9

Where it ranks on Inferse

Sources