Core concept
Envelope encryption: KMS generates data key, encrypts your data, wraps data key with KMS master. Best practice.
Advertisement
How it works
Key rotation: annual for AWS managed, configurable for CMK. Bring Your Own Key (BYOK) supported.
Advertisement
Trade-offs + gotchas
Encryption for S3, EBS, RDS, everything. Cross-account encrypted sharing. Audit via CloudTrail.