Key storage


Each AWS KMS key that you create in AWS KMS costs EUR 1/month (prorated hourly). The EUR 1/month charge is the same for symmetric keys, asymmetric keys, HMAC keys, multi-Region keys (each primary and each replica multi-Region key), keys with imported key material, and KMS keys with a key origin of either AWS CloudHSM or an external key store.


For KMS keys that you rotate automatically or on demand, the first and second rotation of the key adds EUR 1/month (prorated hourly) in cost. This price increase is capped at the second rotation, and any subsequent rotations will not be billed.

You are not charged for the following:

  • Creation and storage of AWS managed or AWS owned KMS keys. These keys are automatically created on your behalf when you first attempt to encrypt a resource in an AWS service that integrates with AWS KMS. You can neither manage the life cycle nor access permissions on AWS managed keys.
  • There is no charge for customer managed KMS keys that you manage and are scheduled for deletion. If you cancel the deletion during the waiting period, the customer managed KMS key will incur charges as though it was never scheduled for deletion.
  • There is no monthly charge for data keys or data key pairs that AWS KMS generates beyond the charge for the API call.
Page-Illo_PricingCalculator_Wallet_1x

AWS Pricing Calculator

Calculate your AWS KMS and architecture cost in a single estimate.

Create your custom estimate now »

Key usage

Note 1: While you are not charged for creation and storage of AWS-managed keys, you will be charged on any API request made to AWS-managed keys.
Note 2: When you use a KMS key in a different AWS account, the AWS account that makes the API request is charged for the key use.

Pricing examples

Amazon EBS example

1 KMS key used as a root key when creating 2500 encrypted EBS volumes per month through the AWS KMS CLI or API operations.

Cost Dimensions:

  • 1 KMS key
  • 3 X 2500 API requests to create and provision a unique data encryption key for each of 250 volumes
 
Monthly cost:
EUR 1.00 1 KMS key
EUR 0.02 7500 requests x EUR 0.03 / 10,000 requests
Total:  
EUR 1.02/month  

Amazon S3 example

1 KMS key used to encrypt 10,000 unique files that are collectively decrypted for access 2,000,000 times per month.

Cost Dimensions:

  • 1 KMS key
  • 10,000 encrypt requests (1 request x 10,000 objects)
  • 2,000,000 decrypt requests to access the objects

Monthly Cost:

EUR 1.00 1 KMS key
EUR 6.03 2,010,000 total requests x EUR 0.03 / 10,000 requests
Total:  
EUR 7.03/month  

File signing application example

1 ECC asymmetric KMS key used to sign 100,000 files through the AWS KMS CLI or APIs operations.

Cost Dimensions:

  • 1 KMS key
  • 100,000 signing requests

Monthly Cost:

EUR 1.00 1 KMS key
EUR 1.50 100,000 requests at EUR 0.15 per 10,000 requests
Total:  
EUR 2.50/month  

AWS CloudTrail logging

If you enable AWS CloudTrail on your account, you can obtain logs of API calls made to or by AWS KMS. See the AWS CloudTrail pricing page for more information.

Additional pricing resources

AWS Pricing Calculator

Easily calculate your monthly costs with AWS.

Get pricing assistance

Contact AWS specialists to get a personalised quote.