kms

Most KMS guides stop at "enable encryption." The architecture decision that actually bites is the key boundary: split one CMK into 3,200 per-tenant keys and you pay ~$3,200/mo in key storage alone while still sharing a single 10,000 req/s symmetric quota. Here is the decision matrix, the throttle math, and the encryption-context pattern that gives per-tenant isolation without per-tenant keys.

EBS default encryption per Region, CMK lifecycle, block public snapshots. July 2026 baseline checklist — retrofit is expensive.

AWS KMS ML-KEM hybrid TLS + ML-DSA signatures. July 2026: when to enable PQC, performance, migration checklist for HNDL risk.