What is AWS KMS and how do you use it

Crisp answer: KMS (Key Management Service) is AWS's managed cryptographic key service. You create and manage keys, and AWS services use them to encrypt data at rest. KMS provides audit trails via CloudTrail, automatic key rotation, and access control via key policies.

Key types:

AWS managed keys:   Created and managed by AWS on your behalf for a service
                    (e.g. aws/s3, aws/rds, aws/ebs)
                    Free. Automatic rotation every year. You cannot delete them.

Customer managed keys (CMK):
                    You create and manage them.
                    $1/month per key.
                    Configurable rotation (on or off, default off).
                    You control who can use them via key policy.
                    Can be deleted (7-30 day pending deletion period).

AWS owned keys:     Fully managed by AWS, not visible in your account.
                    Used for some services transparently.

Key policy:

{
  "Statement": [
    {
      "Sid": "Enable IAM Root",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::123456789:root" },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "Allow Lambda to use the key",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::123456789:role/lambda-role" },
      "Action": [
        "kms:Decrypt",
        "kms:DescribeKey"
      ],
      "Resource": "*"
    }
  ]
}

Common operations:

# Create a key
aws kms create-key \
  --description "my-app encryption key" \
  --region eu-west-2

# Create an alias
aws kms create-alias \
  --alias-name alias/my-app-key \
  --target-key-id arn:aws:kms:eu-west-2:123:key/xxx

# Encrypt data
aws kms encrypt \
  --key-id alias/my-app-key \
  --plaintext "secret data" \
  --output text \
  --query CiphertextBlob

# Decrypt
aws kms decrypt \
  --ciphertext-blob fileb://encrypted.bin \
  --output text \
  --query Plaintext | base64 --decode

# Enable automatic rotation (annual)
aws kms enable-key-rotation --key-id arn:aws:kms:eu-west-2:123:key/xxx

# Schedule key deletion (minimum 7 days)
aws kms schedule-key-deletion \
  --key-id arn:aws:kms:eu-west-2:123:key/xxx \
  --pending-window-in-days 7

CloudTrail audit:

Every KMS API call is logged in CloudTrail. You can see who decrypted what, when, from which IP. This is a key compliance feature.

Important gotcha — RDS and CMK deletion:

If you encrypt an Aurora/RDS cluster with a CMK and then schedule the CMK for deletion, automated snapshots encrypted with that key cannot be restored once the key is deleted. This is why for dev clusters you should use AWS-managed keys (alias/aws/rds) instead of CMKs.

What to say in the interview:

"KMS manages the encryption keys for data at rest across S3, RDS, EBS, and Secrets Manager. For most workloads I use AWS-managed keys: they're free, automatically rotated, and require no management. I reach for CMKs when I need fine-grained access control on who can decrypt, when I need a custom rotation schedule, or when compliance requires keys that I technically own. The operational gotcha: if you encrypt RDS with a CMK and delete the key, you lose access to your snapshots during the 7-30 day pending deletion period. For dev clusters use AWS-managed keys to avoid this."