KMS CMK Key Types

Customer managed CMKs

• Customer managed CMKs are CMKs in your AWS account that you create, own, and manage.

• You have full control over these CMKs, including establishing and maintaining their key policies, IAM policies, and grants, enabling and disabling them, rotating their cryptographic material, etc.

• You can use your customer managed CMKs in cryptographic operations and audit their use in AWS CloudTrail logs.

AWS managed CMKs

• AWS managed CMKs are CMKs in your account that are created, managed, and used on your behalf by an AWS service that is integrated with KMS.

• Some AWS services support only an AWS managed CMK. Others use an AWS owned CMK or offer you a choice of CMKs.

• You can view the AWS managed CMKs in your account, view their key policies, and audit their use in CloudTrail logs.

• You cannot manage these CMKs, rotate them, or change their key policies.

• You cannot use AWS managed CMKs in cryptographic operations directly; the service that creates them uses them on your behalf.

AWS owned CMKs

• AWS owned CMKs are a collection of CMKs that an AWS service owns and manages for use in multiple AWS accounts.

• Although AWS owned CMKs are not in your AWS account, an AWS service can use its AWS owned CMKs to protect the resources in your account.

• You do not need to create or manage the AWS owned CMKs.

• The key rotation strategy for an AWS owned CMK is determined by the AWS service that creates and manages the CMK.