AWS Key Management Service (KMS)
Term 35 of 68 in the ERPStack technical glossary
What is AWS Key Management Service (KMS)?
AWS Key Management Service (KMS) is a secure, managed service that makes it easy for developers to create and control cryptographic keys used to encrypt database columns, files, and server variables.
AWS Key Management Service (KMS) at a glance
- Model
- Envelope encryption in 2 layers — 1 managed master key wraps the data keys that encrypt records
- Cipher
- AES-256 symmetric encryption for data keys; 0 master key material is ever exported
- Rotation
- Scheduled rotation without re-encrypting history, because earlier key versions stay available
- Audit value
- Every key use logged, which answers the 2 questions a reviewer asks: who decrypted what, and when
- Built with
- AWS key management wrapping AES-256 data keys used by PostgreSQL 18 columns, provisioned with Terraform, access gated by RBAC and SSO, key use logged and errors reported to Sentry
- Numbers that matter
- 2 encryption layers; AES-256 data keys; 0 master key material exported; 100% of key uses logged; 1 rotation that re-wraps rather than re-encrypts; 3 policies to review — key, role, and network
- Compare with
- Keys in environment variables, a Microsoft Azure key vault, or 1 shared secret in a Docker image
- Commonly paired with
- PCI DSS, HIPAA and ISO 27001 key controls, a Virtual Private Cloud boundary on AWS, Terraform provisioning, PostgreSQL 18 column encryption, WORM object storage, RBAC and SSO on key policies, and Sentry
- Audit questions
- 2 an assessor asks — who could decrypt, and who did; 100% of key operations logged outside the application boundary
- Rotation period
- Automatic AWS rotation defaults to a 365-day period; earlier key versions stay available, so 0 records are re-encrypted when it fires.
- What the keys protect
- PostgreSQL 18 columns, WORM objects on AWS, Redis snapshots and Docker secrets — 4 stores, 1 master key, 0 plaintext material outside the service.
- Who reads the policy
- 3 documents decide access: key policy, assuming role, network path. healthcare and finance assessors working to HIPAA or PCI DSS read all 3.
How AWS Key Management Service (KMS) works in production
The ERPStack approach to AWS Key Management Service (KMS)
We use AWS KMS to encrypt database columns at the application layer, guaranteeing complete data confidentiality for HIPAA and SOC2 compliance.
Frequently asked questions about AWS Key Management Service (KMS)
What does a Key Management Service actually do?
It holds the keys that protect your keys. A Key Management Service stores master key material inside a hardened boundary and exposes operations to wrap and unwrap data keys, so the application never handles the master secret. Encryption keys stop being configuration values sitting in an environment variable and become a managed resource with access policy, rotation and an audit trail attached.
What is envelope encryption?
Two layers, for practical reasons. Data is encrypted with a per-record or per-file data key, and that data key is itself encrypted by the master key held in the Key Management Service. Bulk encryption stays fast and local, while control of the master key controls access to everything. Rotating the master key re-wraps data keys rather than re-encrypting terabytes of records.
Why does key access logging matter for compliance?
Because it answers questions access control alone cannot. A Key Management Service records every decrypt operation with the identity that requested it, which is exactly the evidence a reviewer wants when asking who could read protected data and whether anyone did. Application-level logs can be tampered with by whoever compromised the application; key-service logs sit outside that boundary.
How does this fit HIPAA or PCI expectations?
It supplies the key-management half of encryption requirements. Encrypting data is straightforward; demonstrating that keys are controlled, rotated, restricted and audited is the part that takes work, and a Key Management Service provides it as a service rather than as a process someone maintains. ERPStack builds systems designed to be auditable against these regimes — we hold no certification ourselves, and the control evidence belongs to the operator.