KMS-Keys and KMS-Requests - $1 per key a month and $0.03 per 10,000 requests

What it costs

US East (N. Virginia); other regions differ. Checked 2026-11-11. Sources: AWS KMS pricing, AWS price list file, AWS KMS offer, us-east-1.

Example with made-up numbers

Typical causes

A key per service and environment

Dev, staging and production each get their own keys, and so does every new service.

Idle keys from retired projects

Nothing deletes a key when the service that used it is gone.

SSE-KMS without Bucket Keys

Every object read and write calls KMS; a busy bucket makes hundreds of millions of calls a month.

Calls with no caching

An app or Lambda function that calls Decrypt on every request instead of caching the data key.

Find it in your bill

Have a CUR file queryable in Athena? Paste this and run it:

SELECT date_trunc('month', line_item_usage_start_date) AS month,
       line_item_product_code,
       line_item_usage_type,
       line_item_resource_id,
       SUM(line_item_usage_amount)  AS usage_amount,
       SUM(line_item_unblended_cost) AS cost
FROM your_cur_table
WHERE line_item_product_code = 'awskms'
  AND (line_item_usage_type LIKE '%KMS-Keys'
       OR line_item_usage_type LIKE '%KMS-Requests')
GROUP BY 1, 2, 3, 4
ORDER BY month DESC, cost DESC
LIMIT 50;

Columns used: line_item_usage_start_date, line_item_product_code, line_item_usage_type, line_item_resource_id, line_item_usage_amount, line_item_unblended_cost.

No CUR file? Use Cost Explorer

1. Open Billing and Cost Management, then Cost Explorer, and set the date range to the last 3 months with Monthly granularity.
2. Set Group by to Usage type.
3. In the Filters panel choose Usage type and tick the entries ending in *KMS-Keys or *KMS-Requests (the region prefix, such as USE1-, differs by region).
4. Read the monthly cost per usage type. A line that grows faster than your traffic is the one to chase with the fix below.
5. To see which resource drives it, query the CUR above; resource IDs appear only if your CUR was set up with resource IDs included, otherwise the resource column is empty.

Column names checked against: docs.aws.amazon.com/cur/latest/userguide/Lineitem-columns.html, docs.aws.amazon.com/cur/latest/userguide/cur-ate-run.html.

The fix, step by step

Verify first

Check these before you change anything: the steps below are suggestions, and only you can see your own configuration.

• Data encrypted under a deleted key is gone for good: EBS volumes, RDS snapshots, S3 objects, backups and secrets may all depend on a key that shows no recent requests.
• Keys that are only used when you restore (backup vaults, disaster-recovery copies) look idle but are not.
• Use the 30-day waiting period: a key pending deletion cannot be used, so anything that still depends on it fails loudly, and you can cancel the deletion.
• S3 Bucket Keys change the encryption context to the bucket ARN; check key policies and IAM conditions that match the object ARN before enabling.
• Bucket Keys apply to new objects; existing objects keep their per-object calls until rewritten.

In the console

1. KMS console > Customer managed keys; list them with their Creation date and Status.
2. For each key, open it and read Key rotation and the Key policy to see which service or role it serves.
3. CloudTrail > Event history, filter Event source kms.amazonaws.com, to see which keys are still called and by whom.
4. For keys nothing uses: Key actions > Schedule key deletion, with a 30-day waiting period.
5. For S3 buckets that use SSE-KMS: bucket > Properties > Default encryption > Edit > Bucket Key > Enable.

With the CLI

aws kms list-keys --query 'Keys[].KeyId' --output text

aws kms list-aliases --query "Aliases[].[AliasName,TargetKeyId]" --output table

aws kms get-key-rotation-status --key-id EXAMPLE

aws kms schedule-key-deletion --key-id EXAMPLE --pending-window-in-days 30

aws kms cancel-key-deletion --key-id EXAMPLE

aws s3api put-bucket-encryption --bucket EXAMPLE --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms","KMSMasterKeyID":"KEY_ARN"},"BucketKeyEnabled":true}]}'

Rollback

Cancel a scheduled deletion with cancel-key-deletion during the waiting period; after the key is deleted nothing can restore it. Bucket Keys: set BucketKeyEnabled to false.

Find your KMS lines in your own bill

Drop in your Cost Explorer or CUR CSV. Billtrim reads it in your browser, finds the KMS key and request lines and shows how many keys you pay for.

Get my ranked savings list See a sample result

Paste your export: how to export a Cost Explorer CSV or CUR file in two minutes.

Questions people ask

Are AWS managed keys free?

Yes. AWS managed keys, such as aws/s3 and aws/ebs, cost nothing a month; only customer managed keys are billed.

Does key rotation cost extra?

The price list prices each customer managed key version, so a rotated key can bill for more than one version. See the pricing page for the current rotation rule.

How many requests are free?

The first 20,000 requests each month.

Related

• AWSSecretsManager-Secrets - $0.40 per secret per month
• Requests-Tier1 and Requests-Tier2 - $0.005 per 1,000 PUTs and $0.0004 per 1,000 GETs
• PaidEventsRecorded and DataEventsRecorded - what CloudTrail bills beyond the free trail

Part of the guide: Reduce your AWS bill as a startup: a checklist for teams with no FinOps person