AWS Key Management Service $($AWS KMS$)$ is a managed service that makes it easy for you to create and control customer master keys $($CMKs$),$ the encryption keys used to encrypt your data. AWS KMS CMKs are protected by hardware security modules $($HSMs$)$ that are validated by the FIPS $140-2$ Cryptographic Module Validation Program.

AWS Key Management Service supports symmetric and asymmetric Customer Master Keys $($CMKs$).$ A symmetric CMK represents a $256-$bit key that is used for encryption and decryption. CMKs are created in AWS KMS$.$ Symmetric CMKs never leave AWS KMS unencrypted. In AWS KMS$,$ a data key DK is created and used for encryption and decryption as shown in Figure $3.$