AWS KMS Pricing Calculator - Keys, Requests & CloudHSM

Customer-managed keys (CMKs) cost $1.00/month each, prorated hourly. AWS-managed keys (automatically created by AWS services) are free. If you store keys in CloudHSM or External Key Store (XKS), there's an additional $1.00/key/month charge on top of the base key storage cost.

The AWS Free Tier includes 20,000 requests/month calculated across all regions. However, this only applies to symmetric operations. Asymmetric operations (Sign, Verify, Encrypt/Decrypt with asymmetric keys) and GenerateDataKeyPair operations are excluded from the free tier.

Use CloudHSM custom key stores when you need dedicated, single-tenant HSMs for regulatory compliance (FIPS 140-2 Level 3). Each CloudHSM instance costs $1.60/hour (~$1,168/month for 24/7). AWS recommends at least 2 HSMs for high availability. For most workloads, standard KMS with AWS-managed HSMs is sufficient and more cost-effective.

Symmetric keys (AES-256) are cheaper ($0.03/10K) and faster for encryption/decryption. Use them for envelope encryption and most data protection. Asymmetric keys (RSA, ECC) are needed for digital signatures, code signing, or when you need to share the public key externally. Note that asymmetric operations cost 5x more ($0.15/10K) than symmetric.

RSA GenerateDataKeyPair costs $12.00/10K requests (400x more than symmetric operations) because generating RSA key pairs is computationally intensive. Consider alternatives: use ECC GenerateDataKeyPair ($0.10/10K) for similar asymmetric capabilities, or use symmetric envelope encryption with GenerateDataKey for most data protection needs.

Automatic key rotation adds $1.00/month for the first two rotations (each creating new key material). Subsequent rotations have no additional charge. This is in addition to the base $1.00/month key storage cost. Keys pending deletion are not charged.