KMS
A service that stores keys in HSM-backed storage and performs cryptographic operations on request, so callers never see the key material.
A KMS (AWS KMS, Google Cloud KMS, Azure Key Vault, HashiCorp Vault transit) holds master keys and exposes operations such as encrypt, decrypt, generate data key, sign and verify. Callers authenticate with IAM; the key itself stays inside HSM-backed infrastructure and is not exportable.
Its real value is policy and audit. Every use of a key is an API call that can be authorised per principal, constrained by encryption context, rate limited, and logged (CloudTrail, Cloud Audit Logs). That turns "who can read this data" into an IAM question.
Common confusion: KMS is not where your data goes; it encrypts small payloads (4 KB in AWS KMS) and wraps data keys for envelope encryption. Designing one yourself in an interview means talking about key hierarchy, HSM roots, multi-region replication, dual control for destructive operations, and what happens when the KMS is down.
Learn it properly
Compared
Also used in
- Cryptography you actually needSecEng · Foundations of Security EngineeringFree
- The security engineering interviewSecEng · Foundations of Security EngineeringFree
- AI in the security SDLCSecEng · AI, vibe coding & logic structuringFree
- TLS and PKI in practiceSecEng · Network & Infrastructure SecurityFree
- Segmentation and zero trustSecEng · Network & Infrastructure SecurityFree
- Key rotation and crypto agilitySecEng · Applied cryptography engineeringFree
- Post-quantum migrationSecEng · Applied cryptography engineeringFree
- The round, the framework, the numbersHLD · The security HLD roundFree