Amazon Key Management Service Pricing

Each customer master key (CMK) that you create in Amazon Key Management Service (KMS) costs ¥6.88/month until you delete it, regardless of where the underlying key material was generated by the service, a custom key store, or you imported it. For multi-Region keys, you are charged for each primary and each replica multi-Region key. For KMS keys that you rotate automatically or on-demand, the first and second rotation of the key adds (prorated hourly) in cost. This price increase is capped at the second rotation, and all rotations after your second rotation are not billed. Data key pairs, which are created by GenerateDataKeyPair and GenerateDataKeyPairWithoutPlaintext API requests are charged for these API requests per the usage pricing discussed below. You are not charged an ongoing monthly fee for the data key pairs themselves as they are neither stored nor managed by the service. In the month a key is created, the ¥6.88 monthly charge for key storage will be a prorated fee to the nearest full hour.

You are not charged for the following:

• Creation and storage of Amazon Web Services managed CMKs. These keys are automatically created on your behalf when you first attempt to encrypt a resource in an Amazon Web Services service that integrates with Amazon KMS. You can neither manage the lifecycle or access permissions on Amazon Web Services managed keys.
• Customer managed CMKs you created that are scheduled for deletion. If you cancel the deletion during the waiting period, the CMK will incur charges as though it was never scheduled for deletion.

Each API request to the Amazon Key Management Service costs:

All China Regions:

• ¥0.20 per 10,000 requests (All APIs except Asymmetric API)
• ¥0.20 per 10,000 requests for RSA 2048 keys
• ¥0.60 per 10,000 ECC GenerateDataKeyPair requests
• ¥1.00 per 10,000 asymmetric requests except RSA 2048
• ¥72.00 per 10,000 RSA GenerateDataKeyPair requests

1 CMK used as a customer managed KMS key when creating 2500 encrypted EBS volumes per month via the Amazon KMS CLI or APIs.

Cost Dimensions:

• 1 CMK
• 3 X 2500 API requests to create and provision a unique data encryption key for each of 2500 volumes
  

1 CMK used to encrypt 10,000 unique files that are collectively decrypted for access 2,000,000 times per month.

Cost Dimensions:

• 1 CMK
• 10,000 Encrypt requests (1 request * 10,000 objects)
  
• 2,000,000 Decrypt requests to access the objects
  

1 ECC 256 CMK used to sign 100,000 files via the Amazon KMS CLI or APIs.

Cost Dimensions:

• 1 CMK
• 100,000 signing requests

If you enable Amazon CloudTrail on your account, you can obtain logs of API calls made to or by Amazon KMS. See the Amazon CloudTrail pricing page for more information.