KMS
Key Management Service
ELI5 — The Vibe Check
KMS is the cloud service that holds your encryption keys in a hardware vault and does crypto operations for you. Need to encrypt something? Send it to KMS. Need to decrypt? Send it to KMS. The keys never leave the secure hardware. It's like a notary who signs documents but never lets you borrow the stamp.
Real Talk
KMS (Key Management Service) is a managed cryptographic key management service available on all major clouds (AWS KMS, GCP Cloud KMS, Azure Key Vault). It provides FIPS 140-2 validated hardware security modules, supports symmetric and asymmetric keys, enables envelope encryption for large data, and integrates with other cloud services for transparent encryption.
When You'll Hear This
"We use AWS KMS to encrypt all sensitive data at rest." / "KMS keys are backed by HSMs and never exported in plaintext."
Related Terms
Encryption
Encryption is scrambling your message into gibberish so only someone with the secret decoder ring can read it.
Envelope Encryption
Envelope Encryption is a two-key system: you encrypt your data with a 'data key,' then encrypt that data key with a 'master key.
HSM (Hardware Security Module)
HSM stands for Hardware Security Module — a tamper-proof physical device that manages cryptographic keys. If someone tries to open it, the keys self-destru
Key Management Service
A Key Management Service (KMS) manages your encryption keys so you don't have to.