What is the difference between AWS managed keys and customer managed keys in KMS?
AWS managed keys are created and rotated by AWS for a service, with a fixed policy you cannot edit. Customer managed keys are created by you, with your own key policy, optional rotation, and the ability to disable or schedule deletion.
Explain it simply
An AWS managed key is a locker the bank provides for each service: convenient, but the bank decides the rules. A customer managed key is a locker you rent and configure yourself, choosing who gets copies of the key and when to change the lock.
Example
AWS managed key Customer managed key
Name : aws/s3, aws/ebs ... alias you choose
Who creates it : AWS, on first use you
Key policy : fixed by AWS you control
Rotation : automatic, yearly optional automatic rotation,
or manual
Disable / delete : no yes (deletion waits 7-30 days)
Cross-account use : not possible possible via key policy
Cost : no monthly key charge monthly key charge + API callsChoose customer managed keys when you need control: audit who can use the key, share it with another account, rotate on your schedule, or satisfy compliance rules. Choose AWS managed keys for convenience when no such control is needed.
KMS keys are Regional, and every use of a key is logged in CloudTrail, which makes audits easier.
What to say in the interview
"AWS managed keys are convenient but fixed. Customer managed keys let me set the key policy, control rotation, share across accounts and disable or delete the key. For regulated or shared data I use customer managed keys."
Common mistakes
- Scheduling deletion of a key that still protects data, which makes that data unreadable.