Security & governance
Key management service (KMS)
A key management service (KMS) is a system that creates, stores and controls the use of cryptographic keys. Applications and storage systems do not hold master keys themselves. They ask the KMS to perform operations with them, and the KMS decides, according to policy, whether each request is allowed and records that it happened.
What does a KMS do?
A KMS covers the life of a key from creation to destruction.
| Function | What it means |
|---|---|
| Generation | Creating keys with a trustworthy source of randomness |
| Storage | Keeping key material protected, often in a hardware security module |
| Access control | Deciding which identities may use which key for which operation |
| Rotation | Replacing keys on a schedule and tracking versions |
| Revocation and destruction | Disabling or deleting a key so data under it cannot be read |
| Audit | Logging every use of every key |
How do storage systems use a KMS?
Storage systems generally use envelope encryption. Each object or volume is encrypted with its own data key. The data key is itself encrypted by a master key that stays in the KMS, and the encrypted data key is stored next to the data. To read, the storage system sends the encrypted data key to the KMS, which returns it in usable form if policy permits. The master key never leaves the KMS. Standard protocols such as KMIP, and vendor-specific APIs, connect storage products to key managers.
Why keep the KMS separate from the storage?
Encryption at rest protects data only if the keys are harder to reach than the data. A storage system that keeps its keys on its own disks, under its own administrators, offers little against someone who has taken over that system. A separate KMS, with different administrators and its own network position, means compromising the storage does not yield the keys, and revoking a key cuts off access regardless of who holds the disks.
What are the operational risks?
The KMS becomes one of the most critical systems in the environment. If it is unavailable, encrypted data cannot be read, so it needs redundancy across sites. If its keys are lost, the data is lost, so key backups have to exist and be protected as carefully as the keys. And it has to be reachable during disaster recovery before most other systems can start, which places it among the first things to restore. Key rotation in object storage and backup encryption keys cover the day-to-day side.
Frequently asked questions
Is a KMS the same as an HSM?
No. A hardware security module is a tamper-resistant device that protects keys. A KMS is the service that manages keys and policy, and often uses an HSM underneath.
Who should administer the KMS?
People separate from the administrators of the systems whose data it protects, so that no single role controls both.
What happens to data if a key is deleted from the KMS?
It can no longer be decrypted. Deleting a key is sometimes used deliberately to make data unrecoverable.
Related terms
- Envelope encryption: the key hierarchy a KMS anchors.
- Encryption at rest: what the managed keys are used for.
- Bring your own key (BYOK): importing customer keys into a provider KMS.
- Hold your own key (HYOK): keeping the KMS outside the provider.
- Encryption in transit: protection for data on the network.