Confusing explanation about how S3 use KMS keys about aws-kms-developer-guide HOT 2 CLOSED

Ah yes, the documentation is not actually clear about it (its confusing I agree).

Here is what I understood, based on my understanding of AWS KMS / CMK:

SSE-KMS supports 2 options:
1/ A customer-managed Customer Master Key (CMK) -- Generated, used and managed by the user
2/ An AWS-managed Customer Master Key (CMK) -- Generated, used, and managed automatically by AWS

What they meant to say is that, in BOTH of the above cases, Data Keys are going to be generated and used to encrypt/decrypt the data. This is the part that says "SSE-KMS requires that AWS manage the data key", and for that part, they should add (whether its a Customer-managed CMK, OR, an AWS-managed-CMK).

Now, for the part: "but you manage the customer master key (CMK) in AWS KMS", it should actually be something like this:

Depending on the two options available for SSE-KMS:

1. if an AWS-managed CMK was selected, then AWS will take care of everything automatically
2. if a customer-managed CMK was selected, then "you manage your own customer master key (CMK) in AWS KMS"

Again, in both above cases, data keys are created / used / removed from memory / regenerated when decryption is needed, all automatically.

from aws-kms-developer-guide.

The topic about S3 encryption with KMS keys is moved to the S3 Developer Guide. Closing this issue. Thanks again for the feedback.

from aws-kms-developer-guide.