StudyToCert

All certifications / Developer Associate / Lessons

AWS Certified Developer – Associate DVA-C02 · Domain 2: Security

AWS KMS: customer managed vs AWS managed keys, envelope encryption with GenerateDataKey, 4 KB Encrypt limit, cross-account key use

▶ Watch the overview video

Last reviewed September 25, 2026 · Leer en español

AWS Key Management Service (KMS) creates and controls cryptographic keys whose key material never leaves KMS unencrypted. Services such as S3, DynamoDB, Lambda and Secrets Manager call KMS for you, and your own code can call it directly.

Free account

Keep reading for free

Create a free StudyToCert account to read the rest of this lesson: 5 more sections, 5 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.

Sign up free Log in

Study Developer Associate for free
A week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.
Open the Developer Associate study plan