AWS Key Management Service (KMS) pricing calculator
Keys, Requests & CloudHSM. Estimate your costs using AWS list prices.
Estimates from AWS list prices, not an AWS quote. Discounts, taxes and credit terms may affect your bill.
01 · How AWS Key Management Service (KMS) pricing works
What you pay for
- $1 per customer managed key per month (prorated hourly); each rotated key version adds $1/month for the first two rotations, per the pricing page.
- Requests: symmetric $0.03 per 10,000; asymmetric and RSA/ECC operations at higher rates (for example RSA data key pair generation $12 per 10,000).
- AWS managed keys have no monthly fee; their requests count toward request charges.
- Custom key stores add CloudHSM charges.
Common cost traps
- S3 SSE-KMS without S3 Bucket Keys makes a KMS request per object operation, which can cost more than the storage.
- Key rotation adds monthly cost per rotated version.
- Per-tenant keys at scale cost $1 each per month.
Ways to reduce cost
- Enable S3 Bucket Keys to cut S3-driven KMS requests by up to 99%.
- Cache data keys in the AWS Encryption SDK.
- Use AWS managed keys where you do not need key policy control.
Free Tier & account eligibility
Free Tier depends on account age. Accounts created on or after 15 July 2025 get a $100 sign-up credit plus up to $100 more for completing onboarding activities; on the Free plan these last 6 months (or until used up), on the Paid plan unused Free Tier credits stay usable for 12 months from sign-up. Accounts created before 15 July 2025 keep the legacy Free Tier (12-month offers plus always-free offers). Always-free offers apply on both plans. Always free on both plans: 20,000 requests per month (excluding some asymmetric and key-pair operations, per the pricing page). AWS managed keys carry no key-storage fee.
02 · AWS credits & runway
Do credits cover AWS Key Management Service (KMS)?
KMS customer managed keys, API requests and custom key store usage are eligible usage and are offset by credits; CloudHSM clusters backing a custom key store are billed under CloudHSM. General rules: credits only offset charges from the billing cycle in which they were applied onward (never past bills), they apply only to the services listed on the credit in Billing and Cost Management > Credits, they expire on the date shown there, and accounts on the AWS Free plan cannot receive Activate credits until they upgrade to the Paid plan.
Check my creditsExcluded charges & conditions
- Upfront payments for Savings Plans and Reserved Instances (All Upfront, and the upfront part of Partial Upfront). The recurring hourly fee of a No Upfront commitment is billed as normal usage and can be offset.
- AWS Marketplace charges (Activate credits make an exception for third-party foundation models used through Amazon Bedrock).
- AWS Enterprise Support, Enterprise On-Ramp, Unified Operations, resold support and partner-led support.
- Amazon Route 53 domain name registration and transfer fees.
- Taxes (sales, use, VAT and similar), AWS Professional Services, Training and Certification, Mechanical Turk, AWS Managed Services, and any use for cryptocurrency mining.
Illustrative credit runway
Single-service examples from the supplied data, not your calculator result. Months = credit amount ÷ monthly cost, before credit expiry. Credits can expire before these theoretical months are used; coverage and other AWS services can shorten runway.
| Usage profile | Monthly estimate | $10,000 | $25,000 | $100,000 |
|---|---|---|---|---|
| Small | $16.00 | 625.0 mo. | 1,562.5 mo. | 6,250.0 mo. |
| Medium | $415.00 | 24.1 mo. | 60.2 mo. | 241.0 mo. |
| Large | $7,000.00 | 1.4 mo. | 3.6 mo. | 14.3 mo. |
Small profile assumptions
10 customer managed keys, 2 M symmetric requests | Customer managed keys: 10 key-months x $1 = $10.00; Symmetric requests: 200 10k requests x $0.03 = $6.00 | Total ~$16.00/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
Medium profile assumptions
100 keys, 100 M symmetric requests, 1 M asymmetric requests | Customer managed keys: 100 key-months x $1 = $100.00; Symmetric requests: 10,000 10k requests x $0.03 = $300.00; Asymmetric requests: 100 10k requests x $0.15 = $15.00 | Total ~$415.00/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
Large profile assumptions
1,000 keys, 2 B symmetric requests (for example S3 SSE-KMS without bucket keys) | Customer managed keys: 1,000 key-months x $1 = $1,000.00; Symmetric requests: 200,000 10k requests x $0.03 = $6,000.00 | Total ~$7,000.00/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
04 · Questions
AWS Key Management Service (KMS) pricing FAQ
What does a KMS key cost?
$1 per customer managed key per month, plus request charges. AWS managed keys have no monthly fee.
How much are requests?
Symmetric requests are $0.03 per 10,000 after the 20,000 free requests per month.
Why is my KMS bill high?
Usually S3 SSE-KMS without Bucket Keys, or applications calling Decrypt on every request.
Do credits cover KMS?
Yes, it is eligible usage.
05 · Sources & estimate notes
Content pack dated 2026-10-19. Calculator rates remain their existing snapshots; this content update is not a price refresh.
Verification notes
- Key-rotation pricing (charge for the first two rotations) and the exact operations excluded from the 20,000 free requests should be confirmed.