Security & identity
AWS Key Management Service (KMS)
- Timebilled
- Bytesnot billed
- Callsbilled
In one line
Two meters running together. A monthly fee per customer-managed key, and a charge on every cryptographic call.
What gets missed
AWS managed keys cost nothing to store, but requests against them still bill. Rotation adds a key-month for the first and second rotation only. Cross-account, the caller pays, not the key owner.
Find it on your bill
Filter Cost Explorer or your Cost and Usage Report by these usage types. A usage type with no region prefix means us-east-1.
KMS-KeysKMS-RequestsKMS-Requests-Asymmetric
Bills the same way
These services turn exactly the same meters, so what you learn here transfers.