KMS centrally stores and manages the encryption keys. These encryption keys are called CMKs. KMS can generate CMKs for you. Alternatively, you can use your own key management infrastructure to generate an encryption key and import it into KMS. AWS uses Hardware Security Modules (HSMs) in order to secure and protect your keys behind the scenes. KMS can process your request to encrypt or decrypt your data using these master keys. You can set up access policies on these keys and these allow you to determine who can access these keys to encrypt and decrypt the data.
KMS can be easily used with a number of AWS services. It also provides integration with client-side toolkits to encrypt data. KMS uses a method called envelope encryption in order to encrypt data. Here, KMS generates a data key that is used to encrypt the data and this data key is also encrypted using...
