AWS KMS is a managed service that enables easy creation and control of encryption keys used to encrypt data.

AWS KMS uses envelope encryption in which data is encrypted using a data key that is then encrypted using a master key. Master keys can also be used to encrypt and decrypt up to 4 kilobytes of data.