AWS KMS: CMK vs AWS Managed Keys
Customer Managed Keys (CMK) vs. AWS Managed Keys
The Ingredients of a Key
- Created automatically by AWS services (S3, EBS, RDS).
- Identified by the format: aws/service-name.
- Free of charge (monthly fee waived).
- Rotation: Automatically every 1,095 days (3 years).
- Created, owned, and managed by you.
- Full control over Key Policies and IAM roles.
- Cost: $1/month per key + API usage.
- Rotation: Optional, every 365 days (configurable).
Management Lifecycle Process
How control levels vary across the lifecycle