AWS bill line item
KMS-Keys
A flat monthly charge (prorated hourly) for every customer-managed key you've created in KMS, whether or not it's ever used to encrypt anything.
KMS customer-managed key, monthly fee
Verified against official AWS documentation last checked
Why it shows up
This is the largest line item for teams that create a lot of keys (one per bucket, one per table, one per environment per service) instead of reusing a small number of keys across resources.
It also spikes when automatic or on-demand key rotation happens: the first rotations of a key's material in a month can each add another prorated monthly charge.
How to cut it
- Consolidate: use one key per service or data-classification tier rather than per resource. Access policies, not key count, should enforce isolation.
- Delete unused keys with no recent decrypt/encrypt activity.
- Avoid enabling automatic rotation on keys that don't need it, and don't trigger repeated on-demand rotations within the same billing month.
- Group by usage type and API operation in Cost Explorer to separate current-key vs. rotated-key charges.
How to read a usage type
KMS-Keys carries no region or direction token, so there's nothing to break down here.
Source
Source: AWS docs →Found KMS-Keys on your own bill?
Drop your Cost Explorer CSV into the AWS Bill Analyzer. It'll flag line items like this one on your own bill and link straight back to the fix.
Analyze your own bill →A bill read by hand goes stale tomorrow.
Reading one export line by line takes real work. CostMon reads the next one for you, every day, for every provider you connect.