July 13, 2021 . 3 MIN READ
https://aws.amazon.com/kms/pricing/
Each customer master key (CMK) that you create in AWS Key Management Service (KMS) costs $1/month until you delete it, regardless of where the underlying key material was generated by the service, a custom key store, or you imported it. For a CMK with key material generated by the service, if you opt-in to have it automatically rotate the key each year, each new key version raises the cost of the CMK by $1/month. AWS KMS retains and manages each previous version of the CMK to ensure you can decrypt data encrypted under previous versions. Data key pairs, which are created by GenerateDataKeyPair and GenerateDataKeyPairWithoutPlaintext API requests are charged for these API requests per the usage pricing discussed below. You are not charged an ongoing monthly fee for the data key pairs themselves as they are neither stored nor managed by the service. In the month a key is created, the $1 monthly charge for key storage will be a prorated fee to the nearest full hour.
You are not charged for the following:
Try AWS Key Management Service
AWS Free Tier includes 20,000 free AWS Key Management Service requests each month.
View AWS Free Tier Details »
Try AWS Key Management Service Free
Each API request to the AWS Key Management Service (outside of the free tier) costs:
Region:
You have the option of using an AWS CloudHSM cluster to generate and store your CMKs. The use of a custom key store does not affect the charges for storing and using a CMK. However, a custom key store does require you to maintain an AWS CloudHSM cluster that contains at least two HSMs. More HSMs can be added for improved availability and performance. The standard AWS CloudHSM charges apply. See the pricing example.
AWS Key Management Service provides a free tier of 20,000 requests/month calculated across all regions that the service is available.
*Requests to the GenerateDataKeyPair and GenerateDataKeyPairWithoutPlaintext APIs and requests to APIs such as Sign, Verify, Encrypt, Decrypt, and GetPublicKey that reference asymmetric CMKs are excluded from the free tier.
1 CMK used as a master key when creating 250 encrypted EBS volumes per month via the AWS KMS CLI or APIs.
Cost Dimensions:
Monthly cost:
| $1.00 | 1 CMK |
| $0.00 | 0 requests (750 requests – 20,000 free tier requests) |
| Total: | |
| $1/month |
1 CMK used to encrypt 10,000 unique files that are collectively decrypted for access 2,000,000 times per month.
Cost Dimensions:
Monthly Cost:
| $1.00 | 1 CMK |
| $5.97 | 1,990,000 requests (2,010,000 total requests – 20,000 free tier requests) x $0.03 / 10,000 requests |
| Total: | |
| $6.97/month |
1 CMK used to encrypt 10,000 unique files that are collectively decrypted for access 2,000,000 times per month. A CloudHSM cluster containing 2 HSMs is maintained in US East (N. Virginia) for the entire month.
Cost Dimensions:
Monthly Cost:
| $1.00 | 1 CMK |
| $5.97 | 1,990,000 requests (2,010,000 total requests – 20,000 free tier requests) x $0.03 / 10,000 requests |
| $2,380.80 | 31 days for 2 HSMs x $1.60 / HSM / hour |
| Total: | |
| $2,387.77/month |
1 ECC 256 CMK used to sign 100,000 files via the AWS KMS CLI or APIs.
Cost Dimensions:
Monthly Cost:
| $1.00 | 1 CMK |
| $1.50 | 100,000 requests at $0.15 per 10,000 requests |
| Total: | |
| $2.50/month |
If you enable AWS CloudTrail on your account, you can obtain logs of API calls made to or by AWS KMS. See the AWS CloudTrail pricing page for more information.
