AWSAWS Key Management ServiceSecurity & Identity

`aws_kms_grant` cost estimation

A temporary, scoped permission to use a KMS key. Grants are free. The key it points at costs about $1/month, and the encrypt/decrypt API calls the grant enables bill per request.

The aws_kms_grant resource creates a grant, a flexible and often temporary way to delegate use of a KMS key to a principal for specific operations (Encrypt, Decrypt, GenerateDataKey, and so on), optionally constrained by encryption context. AWS services like EBS, RDS, and Lambda create grants automatically when they need to use a customer managed key on your behalf. Creating a grant is free, there is no per-grant charge.

The cost lives in two places around the grant. First, the KMS key itself: each customer managed key (aws_kms_key) costs about 1.00 dollars per month, prorated, and each additional key version from automatic rotation is also billed at about 1.00 dollars per month. AWS managed keys are free, but customer managed keys are not. Second, and usually the larger number at scale, the cryptographic API requests the grant permits: KMS charges about 0.03 dollars per 10,000 requests for standard Encrypt, Decrypt, and GenerateDataKey calls. A workload that calls Decrypt on every request rather than caching data keys can turn that into a meaningful monthly line item.

The grant is cost-adjacent because it authorizes those billable API calls. It does not add cost by existing, but the pattern of use it enables does. A common efficiency issue is envelope-encryption code that calls GenerateDataKey or Decrypt per object instead of caching the plaintext data key for a batch; the grant is free either way, but the request volume it unlocks differs by orders of magnitude.

Two more cost notes. KMS has a per-key limit on the number of active grants (currently 50,000), which is an operational rather than billing constraint but drives design toward reusing grants. And ECDSA or RSA asymmetric operations, and calls to keys in a custom key store backed by CloudHSM, are priced higher than symmetric requests, with the CloudHSM cluster itself billing separately by the hour.

c3x reports aws_kms_grant as free and attributes spend to the aws_kms_key (about 1 dollar per key per month) plus the per-request KMS API charges the workload generates.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_kms_key" "data" {
  description             = "envelope encryption key"
  deletion_window_in_days = 7
}

resource "aws_iam_role" "worker" {
  name = "encryption-worker"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action    = "sts:AssumeRole"
      Effect    = "Allow"
      Principal = { Service = "lambda.amazonaws.com" }
    }]
  })
}

# Free grant that lets the worker generate and decrypt data keys only.
resource "aws_kms_grant" "worker" {
  name              = "worker-envelope-encryption"
  key_id            = aws_kms_key.data.key_id
  grantee_principal = aws_iam_role.worker.arn
  operations        = ["GenerateDataKey", "Decrypt"]
}

Pricing dimensions

What you actually pay for when you provision aws_kms_grant.

Dimension	Unit	What's being charged
KMS grant	free	Creating or retiring a grant is free. There is no per-grant charge. $0 (free)
Customer managed key	per key per month	Each customer managed key costs a flat monthly fee, prorated. Each rotated key version is also billed. $1.00 per key per month (AWS managed keys are free)
KMS API requests (symmetric)	per 10,000 requests	Encrypt, Decrypt, and GenerateDataKey calls the grant enables, often the largest KMS cost at scale. $0.03 per 10,000 requests
KMS API requests (asymmetric)	per 10,000 requests	RSA and ECDSA operations are priced higher than symmetric requests. $0.15 per 10,000 requests (RSA 2048)

Optimization tips

Common ways to reduce aws_kms_grant cost without changing the workload.

Cache data keys instead of calling Decrypt per operation

Large reduction in per-request KMS charges at scale

Envelope encryption should generate or decrypt a data key once and reuse the plaintext for a batch of objects. The grant is free, but per-object KMS calls bill at 0.03 dollars per 10,000. Data key caching can cut request volume by orders of magnitude.

Use AWS managed keys where they suffice

$1/month per customer managed key avoided

AWS managed keys (aws/s3, aws/ebs, and so on) are free, while each customer managed key is about 1 dollar per month. Reserve customer managed keys for cases that genuinely need custom policies, rotation control, or cross-account grants.

Share one key across a workload rather than one key per object

$1/month per key not created

Because keys bill monthly, creating many keys multiplies the flat fee. Use encryption context on a shared key to separate tenants or datasets instead of provisioning a key each.

Reuse grants and clean up stale ones

Grants are free but capped per key (50,000 active). Reuse a grant for a role rather than minting one per invocation, and retire grants that are no longer needed to stay under the limit and keep the key's access surface clean.

FAQ

Does a KMS grant cost anything?

No. Creating, using, and retiring grants is free. The cost around a grant is the KMS key it points at (about 1 dollar per month for a customer managed key) and the per-request charges for the Encrypt, Decrypt, and GenerateDataKey calls the grant permits.

What does the underlying KMS key cost?

A customer managed key is about 1.00 dollar per month, prorated, and each version created by automatic rotation adds another 1 dollar per month. AWS managed keys are free. On top of that, cryptographic API requests bill at about 0.03 dollars per 10,000 for symmetric operations.

How do grants relate to KMS cost at scale?

A grant authorizes API calls but does not bill for them. The cost driver is how often the granted principal calls KMS. Code that decrypts per object rather than caching a data key generates far more billable requests, so the usage pattern the grant enables matters more than the grant itself.

When should I use a grant versus a key policy?

Grants are ideal for temporary, programmatic, and finely scoped delegation, especially the ones AWS services create automatically. Key policies and IAM are better for stable, human-managed access. Both are free; grants shine for short-lived, per-principal permissions.