KMS CMK Key Types

Customer managed CMKs

Customer managed CMKs are CMKs in your AWS account that you create, own, and manage.
You have full control over these CMKs, including establishing and maintaining their key policies, IAM policies, and grants, enabling and disabling them, rotating their cryptographic material, etc.
You can use your customer managed CMKs in cryptographic operations and audit their use in AWS CloudTrail logs.

AWS managed CMKs are CMKs in your account that are created, managed, and used on your behalf by an AWS service that is integrated with KMS.
Some AWS services support only an AWS managed CMK. Others use an AWS owned CMK or offer you a choice of CMKs.
You can view the AWS managed CMKs in your account, view their key policies, and audit their use in CloudTrail logs.
You cannot manage these CMKs, rotate them, or change their key policies.
You cannot use AWS managed CMKs in cryptographic operations directly; the service that creates them uses them on your behalf.

AWS owned CMKs are a collection of CMKs that an AWS service owns and manages for use in multiple AWS accounts.
Although AWS owned CMKs are not in your AWS account, an AWS service can use its AWS owned CMKs to protect the resources in your account.
You do not need to create or manage the AWS owned CMKs.
The key rotation strategy for an AWS owned CMK is determined by the AWS service that creates and manages the CMK.

Last updated 4 years ago

Was this helpful?

Customer managed CMKs are CMKs in your AWS account that you create, own, and manage.
You have full control over these CMKs, including establishing and maintaining their key policies, IAM policies, and grants, enabling and disabling them, rotating their cryptographic material, etc.
You can use your customer managed CMKs in cryptographic operations and audit their use in AWS CloudTrail logs.

AWS managed CMKs are CMKs in your account that are created, managed, and used on your behalf by an AWS service that is integrated with KMS.
Some AWS services support only an AWS managed CMK. Others use an AWS owned CMK or offer you a choice of CMKs.
You can view the AWS managed CMKs in your account, view their key policies, and audit their use in CloudTrail logs.
You cannot manage these CMKs, rotate them, or change their key policies.
You cannot use AWS managed CMKs in cryptographic operations directly; the service that creates them uses them on your behalf.

AWS owned CMKs are a collection of CMKs that an AWS service owns and manages for use in multiple AWS accounts.
Although AWS owned CMKs are not in your AWS account, an AWS service can use its AWS owned CMKs to protect the resources in your account.
You do not need to create or manage the AWS owned CMKs.
The key rotation strategy for an AWS owned CMK is determined by the AWS service that creates and manages the CMK.

Last updated 4 years ago

Was this helpful?