---
title: AWS Key Management Service (KMS)
description: Arpio replicates KMS Key and KMS Alias resources.
---

[Skip to content](https://docs.arpio.io/kms#main-content)

English

Show submenu for translations

[Customer ticket portal](https://docs.arpio.io/tickets-view?hsLang=en)

- Home
- Products
- Pricing
- Blog
- Company

Open main navigation

Close main navigation

- Home
- Products
- Pricing
- Blog
- Company
- English
  
  Show submenu for translations
- [Customer ticket portal](https://docs.arpio.io/tickets-view)

 Welcome to Arpio Technical Docs

- There are no suggestions because the search field is empty.

1. [Arpio Documentation](https://docs.arpio.io/?hsLang=en)
2. [AWS Reference Guides](https://docs.arpio.io/aws-reference-guides?hsLang=en)
3. [AWS Resource Reference](https://docs.arpio.io/aws-reference-guides?hsLang=en#aws-resource-reference)

# AWS Key Management Service (KMS)

## AWS KMS resource replication with Arpio

#### KMS Resources

Arpio replicates the following KMS resource types. Jump to:

- [KMS Key](https://docs.arpio.io/kms#key)
- [KMS Alias](https://docs.arpio.io/kms#alias)

### KMS Key

Arpio replicates customer-managed KMS Keys and their associated aliases to the recovery environment.  This allows policies and resources that reference the key to continue operating with the same level of trust in the recovery environment. 

 

**Note:** the key material itself is **not** replicated, so any data that is encrypted with the key in the primary environment cannot be decrypted with the replica of the key in the recovery environment. For resources that Arpio manages that are encrypted with custom keys (such as Secrets Manager Secrets), Arpio recreates these in the recovery environment with the replica keys, which causes them to be re-encrypted with the new key material.

#### Selection

The following resources are automatically selected into recovery points when a KMS Key is selected:

- Resources and IAM roles that are referenced within the key’s policy
- KMS Aliases that are pointed to the key

#### Translation

The following attributes are translated during replication:

| **Attribute** | **Translation** |
| --- | --- |
| Resource Policy | Arpio replicates the policy from the primary key to the recovery key.  During a test or a failover, the primary key statements are included and translated according to the policy document translation process. |

### KMS Alias

Arpio replicates AWS-managed and customer-managed KMS Aliases and their associated keys to the recovery environment.  

#### Selection

The following resources are automatically selected into recovery points when a KMS Alias is selected:

- The KMS Key that the alias is pointed to

#### Translation

The following attributes are translated during replication:

| **Attribute** | **Translation** |
| --- | --- |
| KMS Key | Aliases in the recovery environment are updated to point to the mirror of the corresponding key in the recovery environment |

- [Getting Started](https://docs.arpio.io/getting-started?hsLang=en#main-content)

    - [New Account Setup](https://docs.arpio.io/getting-started?hsLang=en#new-account-setup)
    - [New Application Setup](https://docs.arpio.io/getting-started?hsLang=en#new-application-setup)
- [Arpio Fundamentals](https://docs.arpio.io/arpio-fundamentals?hsLang=en#main-content)

    - [Platform Fundamentals](https://docs.arpio.io/arpio-fundamentals?hsLang=en#platform-fundamentals)
    - [Platform Features](https://docs.arpio.io/arpio-fundamentals?hsLang=en#platform-features)
- [Arpio Reference Guides](https://docs.arpio.io/arpio-reference-guides?hsLang=en#main-content)

    - [Arpio API](https://docs.arpio.io/arpio-reference-guides?hsLang=en#arpio-api)
    - [Lifecycle Events](https://docs.arpio.io/arpio-reference-guides?hsLang=en#lifecycle-events)
    - [Role-Based Access Controls (RBAC)](https://docs.arpio.io/arpio-reference-guides?hsLang=en#role-based-access-controls-rbac)
    - [Single Sign-On (SSO) Integration](https://docs.arpio.io/arpio-reference-guides?hsLang=en#single-sign-on-sso-integration)
    - [Test Planning](https://docs.arpio.io/arpio-reference-guides?hsLang=en#test-planning)
    - [Test & Recovery How-To](https://docs.arpio.io/arpio-reference-guides?hsLang=en#test-recovery-how-to)
- [AWS Reference Guides](https://docs.arpio.io/aws-reference-guides?hsLang=en#main-content)

    - [AWS Resource Reference](https://docs.arpio.io/aws-reference-guides?hsLang=en#aws-resource-reference)
    - [AWS Configuration Tags](https://docs.arpio.io/aws-reference-guides?hsLang=en#aws-configuration-tags)
    - [AWS Access](https://docs.arpio.io/aws-reference-guides?hsLang=en#aws-access)
    - [AWS Testing](https://docs.arpio.io/aws-reference-guides?hsLang=en#aws-testing)
    - [AWS Solutions](https://docs.arpio.io/aws-reference-guides?hsLang=en#aws-solutions)
- [Azure Reference Guides](https://docs.arpio.io/azure-reference-guides?hsLang=en#main-content)

    - [Azure Resource Reference](https://docs.arpio.io/azure-reference-guides?hsLang=en#azure-resource-reference)
    - [Azure Configuration Tags](https://docs.arpio.io/azure-reference-guides?hsLang=en#azure-configuration-tags)
    - [Azure Scenarios](https://docs.arpio.io/azure-reference-guides?hsLang=en#azure-scenarios)
- [FAQ](https://docs.arpio.io/faq?hsLang=en#main-content)

    - [AWS FAQ](https://docs.arpio.io/faq?hsLang=en#aws-faq)
    - [Contact Support](https://docs.arpio.io/faq?hsLang=en#contact-support)
    - [License & Billing](https://docs.arpio.io/faq?hsLang=en#license-billing)
    - [Tests and Recoveries](https://docs.arpio.io/faq?hsLang=en#tests-and-recoveries)

- Home
- Products
- Pricing
- Blog
- Company

[![bubble-wand-tight.64](https://docs.arpio.io/hs-fs/hubfs/bubble-wand-tight.64.png?width=64&height=64&name=bubble-wand-tight.64.png "bubble-wand-tight.64")](https://arpio.io)

Copyright © 2026, Arpio