Key material is essentially the data that is used to encrypt and decrypt data and is stored within your CMK. Hence, in the example I just covered with SSE-KMS, the CMK key material was used to encrypt a version of the data key as well as to decrypt an encrypted version of the data key.Â
When you create your CMK, KMS automatically creates new key material for that CMK. However, when you are creating your own customer-managed CMKs, you can choose to create your CMK without any key material, allowing you to import your own into the key yourself. This method of key material assignment is known as Bring Your Own Key (BYOK).Â
However, it is important to note that imported key material does not support automatic key rotation, but it is possible to manually rotate your keys with imported material.
