← All platforms
AAWS KMS
The default if you are on AWS — a dollar a key, and every other AWS service already knows how to use it.
Cloud KMSEncryption keysBy AmazonSince 2014
- Type
- Cloud KMS
- How it works
- Keys never leave the service — you call it to encrypt and decrypt rather than fetching key material. Envelope encryption is the normal pattern: KMS protects a data key, the data key protects your data. Every AWS service integrates natively, which is most of the value.
- Scope
- Encryption keys
- Deployment
- SaaS (AWS)
- Hardware / key custody
- FIPS 140-3 Level 3 validated HSMs
- Pricing*
- $1/key/mo + $0.03 per 10k requests · pricing page
- Free tier
- Yes
- Licence
- —
- Best for
- Anything already running on AWS
- Notable
- 20,000 free requests a month
* Published list pricing at August 2026 (vendor pricing pages, August 2026), not a quote.
Strengths
- Integrated with essentially every AWS service
- Key material never leaves the HSM boundary
- Trivially cheap at small and moderate scale
- IAM policies you already know
Trade-offs
- Manages keys, not application secrets
- Costs climb with request volume, not key count
- AWS-shaped: awkward outside it
- External key stores add real latency
Visit AWS KMS → Documentation
Listed for comparison as of August 2026 — not an endorsement, and AWS KMS did not pay for placement. See disclosure.
Compare AWS KMS with…