AWS › AWS KMS & Data Encryption

What is the difference between a customer managed key and an AWS managed key in KMS?

Beginner

Answer

A customer managed key is a KMS key that you create and fully control, including defining its key policy, rotation schedule, and who can use it, while an AWS managed key is automatically created and managed by AWS on your behalf for a specific service, offering less control and customization but requiring no setup effort, meaning customer managed keys are generally chosen when you need fine grained control over exactly who can use a key or need to share it across specific accounts or services.

aws kms create-key --policy file://key-policy.json --description 'Customer managed key for finance data'

Real-world example A finance department creates its own customer managed KMS key with a strict key policy limiting usage to only specific finance team IAM roles, rather than relying on the default AWS managed key used broadly across the rest of the organization.

Common follow-ups: Can an AWS managed key be shared across multiple AWS accounts?;How do you decide when a customer managed key is necessary instead of an AWS managed key?

IAM;AWS Organizations & Multi Account Strategy