Under this method, AWS KMS generates data keys which are used to encrypt data locally in the AWS service or your application. The data keys are themselves encrypted under a KMS key you define. Data keys are not retained or managed by AWS KMS.

What is KMS and how does it work?

AWS KMS is a managed service that is integrated with various other AWS Services. You can use it in your applications to create, store and control encryption keys to encrypt your data. KMS allows you to gain more control for access to the data that you encrypt. KMS assures 99.99999999999% durability of the keys.

What is the basic use of KMS?

You can use a KMS key to encrypt, decrypt, and re-encrypt data. It can also generate data keys that you can use outside of AWS KMS. Typically, you’ll use symmetric KMS keys, but you can create and use asymmetric KMS keys for encryption or signing.