AWS KMS Pricing Calculator - Keys, Requests & CloudHSM

KMS has five pricing tiers for API requests (per 10,000 requests): Symmetric operations ($0.03) for Encrypt, Decrypt, GenerateDataKey; RSA 2048 operations ($0.03); Other asymmetric ($0.15); ECC GenerateDataKeyPair ($0.10); and RSA GenerateDataKeyPair ($12.00).

Customer-managed keys (CMKs) cost $1.00/month each, prorated hourly. AWS-managed keys are free. If you store keys in CloudHSM or External Key Store (XKS), there's an additional $1.00/key/month charge on top of the base key storage cost.

The AWS Free Tier includes 20,000 requests/month calculated across all regions. However, this only applies to symmetric operations. Asymmetric operations and GenerateDataKeyPair operations are excluded from the free tier.

Use CloudHSM custom key stores when you need dedicated, single-tenant HSMs for regulatory compliance. Each CloudHSM instance costs $1.60/hour (~$1,168/month for 24/7). AWS recommends at least 2 HSMs for high availability.

Symmetric keys (AES-256) are cheaper ($0.03/10K) and faster for encryption/decryption. Asymmetric keys (RSA, ECC) are needed for digital signatures, code signing, or when you need to share the public key externally.

RSA GenerateDataKeyPair costs $12.00/10K requests because generating RSA key pairs is computationally intensive. Consider alternatives like ECC GenerateDataKeyPair ($0.10/10K) or symmetric envelope encryption when possible.