Each AWS KMS key that you create in AWS KMS costs $1/month (prorated hourly). The $1/month charge is the same for symmetric keys, asymmetric keys, HMAC keys, multi-Region keys (each primary and each replica multi-Region key), keys with imported key material, and KMS keys with a key origin of either AWS CloudHSM or an external key store (XKS). \n
For KMS keys that you rotate automatically or on demand, the first and second rotation of the key adds $1/month (prorated hourly) in cost. This price increase is capped at the second rotation, and any subsequent rotations will not be billed. \n
You are not charged for the following: \n
Each AWS KMS key that you create in AWS KMS costs $1/month (prorated hourly). The $1/month charge is the same for symmetric keys, asymmetric keys, HMAC keys, multi-Region keys (each primary and each replica multi-Region key), keys with imported key material, and KMS keys with a key origin of either AWS CloudHSM or an external key store (XKS).
For KMS keys that you rotate automatically or on demand, the first and second rotation of the key adds $1/month (prorated hourly) in cost. This price increase is capped at the second rotation, and any subsequent rotations will not be billed.
You are not charged for the following:
Note 1: While you are not charged for creation and storage of AWS-managed keys, you will be charged on any API request made to AWS-managed keys.
Note 2: When you use a KMS key in a different AWS account, the AWS account that makes the API request is charged for the key use.
You have the option of using an AWS CloudHSM cluster or an external key manager to generate and store your KMS keys. These keys will also cost $1/month (prorated hourly). If using AWS CloudHSM, standard AWS CloudHSM charges apply. See this pricing example.
AWS KMS provides a free tier of 20,000 requests/month calculated across all Regions that the service is available.
*Requests to the GenerateDataKeyPair and GenerateDataKeyPairWithoutPlaintext API operations and requests to API operations such as Sign, Verify, Encrypt, Decrypt, and GetPublicKey that reference asymmetric KMS keys are excluded from the free tier.
1 KMS key used as a root key when creating 250 encrypted EBS volumes per month through the AWS KMS CLI or API operations.
Cost Dimensions:
| $1.00 | 1 KMS key |
| $0.00 | 0 requests (750 requests - 20,000 free tier requests) |
| Total: | |
| $1/month |
1 KMS key used to encrypt 10,000 unique files that are collectively decrypted for access 2,000,000 times per month.
Cost Dimensions:
Monthly Cost:
| $1.00 | 1 KMS key |
| $5.97 | 1,990,000 requests (2,010,000 total requests - 20,000 free tier requests) x $0.03 / 10,000 requests |
| Total: | |
| $6.97/month |
1 KMS key used to encrypt 10,000 unique files that are collectively decrypted for access 2,000,000 times per month. A CloudHSM cluster containing 2 HSMs is maintained in US East (N. Virginia) for the entire month.
Cost Dimensions:
Monthly Cost:
| $1.00 | 1 KMS key |
| $5.97 | 1,990,000 requests (2,010,000 total requests - 20,000 free tier requests) x $0.03 / 10,000 requests |
| $2,380.80 | 31 days for 2 HSMs x $1.60 / HSM / hour |
| Total: | |
| $2,387.77/month |
1 ECC 256 KMS key used to sign 100,000 files through the AWS KMS CLI or APIs operations.
Cost Dimensions:
Monthly Cost:
| $1.00 | 1 KMS key |
| $1.50 | 100,000 requests at $0.15 per 10,000 requests |
| Total: | |
| $2.50/month |
If you enable AWS CloudTrail on your account, you can obtain logs of API calls made to or by AWS KMS. See the AWS CloudTrail pricing page for more information.
Easily calculate your monthly costs with AWS.
Contact AWS specialists to get a personalized quote.
