Reviewed by Aditya Kumar · Last reviewed 2026-03-24
**KMS role**: Centralized key management. Creates and controls encryption keys. Used by S3, EBS, RDS, Lambda for encryption. **Why KMS**: Key lifecycle (creation, rotation, deletion); audit via CloudTrail; access control via IAM. **CMK**: Customer-managed keys—you control policy...
KMS role: Centralized key management. Creates and controls encryption keys. Used by S3, EBS, RDS, Lambda for encryption. Why KMS: Key lifecycle (creation, rotation, deletion); audit via CloudTrail; access control via IAM. CMK: Customer-managed keys—you control policy and rotation. AWS-managed keys are simpler but less control. Best practice: Use CMK for compliance (audit trail). Enable automatic rotation (annual for symmetric). Cost: $1/month per key; $0.03/10K requests. At scale, consider data key caching.
Pro-Move: 'We use one CMK per environment—dev/prod isolation; annual rotation; CloudTrail for every encrypt/decrypt in compliance reports.' Red Flag: Relying only on default encryption without key management—no audit trail.
According to DataEngPrep.tech, this is one of the most frequently asked Cloud/Tools interview questions, reported at 1 company. DataEngPrep.tech maintains an editor-reviewed database of 1,863 data engineering interview questions across 7 categories.