Avoid risk and complexity as you build encryption into your own systems. Using simple APIs you can use Amazon KMS as a centralized data encryption service. You can also build encryption capabilities directly into your applications using the Amazon Web Services Encryption SDK and manage your keys through its integration with Amazon KMS.

Amazon Web Services manages the security controls required to protect your keys from unauthorized physical access. You manage the access policies and lifecycle of keys to protect them from unauthorized logical access. Your keys are protected by government-approved hardware security modules (HSMs). Once created, your master keys can only be used inside the government-approved HSMs. There are no mechanisms for anyone, including service operators, to export or view your keys.