KMS, Keys, and Certificates

The cryptographic foundation: envelope encryption and encryption context, the three key types and the key policy that is the root of a key’s authority, grants and kms:ViaService, multi-Region keys, CloudHSM and external key stores, imported key material, and certificates from ACM and Private CA.

Content current as of 2026-10.

Lessons

  1. Envelope encryption
  2. Key types, key policies, and grants
  3. Multi-Region keys, CloudHSM, and external key stores
  4. Imported key material
  5. Certificates, ACM, and Private CA

Sources