Sold by: COSMIAN
Deployed on AWS
This Customer Managed Key Management System has charges associated with the use of the software from UAT to Production and also standard support from Cosmian.
Overview
This is a repackaged software wherein additional charges apply for extended support.
Cosmian kms is a modern, cloud-ready key management system for your encryption keys and certificates, running inside a Cosmian vm - a verifiable and confidential virtual machine.
This ensures that your KMS remains entirely confidential, at rest and in use, and is verifiable (no hardware of software tampering).
Cosmian kms delivers unparalleled data security for your organization with an on-the-fly encryption/decryption keys solution, empowering sovereignty, security, and efficiency.
-
Protect your data sovereignty with our independent security solution, eliminating reliance on public cloud providers.
-
Strengthen your security posture by taking charge of sensitive data encryption, including workspace, R&D data, HR information, and electronic communications.
-
Streamline your IT system and server management with automated processes, empowering your system administrators to boost productivity and efficiency in infrastructure management.
What is in Cosmian kms? Modern lifecycle management for keys and certificates : Cosmian kms offer cutting-edge features for managing encryption keys and certificates throughout their lifecycle.
- Key storage
- Key generation
- Key rotation
- Key distribution
- Key usage policies
Advanced Public Key Infrastructure integration : Integrating seamlessly with external entities, the Cosmian kms facilitates Public Key Infrastructure management beyond the confines of your organization. Whether it's leveraging third-party actors or overseeing key governance, we ensure a streamlined and secure process.
Embedding standard and modern encryption libraries : Embracing both standard and contemporary cryptographic algorithms, the Cosmian kms boasts an unparalleled breadth of coverage.
- FIPS 140-3 validated encryption libraries
- Covercrypt: Post-quantum resistance & access policy
- Findex: search encryption
Highlights
- Advanced Key Management for crypto-agility / Enhanced Data Protection / Zero Trust KMS Strategy / Scalability and Flexibility
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time. Alternatively, you can pay upfront for a contract, which typically covers your anticipated usage for the contract duration. Any usage beyond contract will incur additional usage-based costs.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
c6a.xlarge Recommended | $3.04 |
r6a.xlarge | $3.04 |
c6a.2xlarge | $6.08 |
r6a.12xlarge | $36.48 |
r6a.metal | $145.92 |
r6a.24xlarge | $72.96 |
c6a.4xlarge | $12.16 |
m6a.metal | $145.92 |
r6a.32xlarge | $97.28 |
m6a.48xlarge | $145.92 |
Dimensions summary
You pay by the hour for the EC2 instance type you run this key management software on. All 30 options bill the same way — only the underlying instance size and family differ. The c6a family is compute-optimized, m6a is general-purpose, and r6a is memory-optimized. Within each family, sizes scale from xlarge up through 48xlarge, plus bare-metal options. Larger sizes carry more CPU and memory, so their hourly rate rises accordingly. Pick the instance that matches your workload; there are no tiers, commitments, or add-ons. Billing stops when you stop the instance.
Top-of-mind questions for buyers
Each hourly rate covers one running EC2 instance of the chosen type, with the key management software preinstalled. The instance uses AMD SEV-SNP, a hardware feature that keeps memory encrypted while the software processes keys and certificates. You pick the CPU and memory size that fits your workload.
Software charges meter running time only. A stopped instance stops accruing the hourly software fee. You may still pay underlying AWS storage costs for the instance while it sits idle. To stop all software charges, terminate or stop the instance.
Each instance bills at its own hourly rate for the hours it runs. Moving a workload from a c6a or m6a instance to an r6a instance changes only that instance's rate. There are no tiers, so the change takes effect immediately and applies per instance, not across your account.
ressources.cosmian.com
Helpful?
Vendor refund policy
We apply the standard refund policy from AWS which states that refund can be done directly through AWS within the first 48 hours. After that no refund will be taken into account.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
VERSION 5.26.0 - August 7, 2026
SECURITY
This release resolves 8 Dependabot security alerts. The opentelemetry_sdk dependency has been upgraded from version 0.29.0 to 0.32.1, addressing a Server-Side Request Forgery vulnerability via malicious OTLP endpoints (GHSA-r74r-p7x6-m97p). React dependencies have also been updated.
The AlwaysSensitive attribute is now server-managed. Clients can no longer add, set, modify, or delete this attribute via AddAttribute, SetAttribute, ModifyAttribute, or DeleteAttribute operations. Such requests are rejected with an Attribute_Read_Only error.
Previously, read-only KMIP attributes could be rewritten by any client via ModifyAttribute, including attributes such as Initial Date, Cryptographic Length, and Unique Identifier. All attributes marked as not modifiable by the client are now rejected with Attribute_Read_Only. Attributes marked as not deletable by the client are rejected by DeleteAttribute.
SPIRE AND WORKLOAD IDENTITY
Cosmian KMS now supports SPIRE server integration. The KMS acts as a Vault-compatible backend for the SPIRE upstream_ca plugin, supporting PKI sign-intermediate, Transit encrypt/decrypt, and Auth AppRole/Kubernetes authentication modes.
Multi-tenant SPIRE integration is available with isolated trust domains per SPIFFE ID. The X-Vault-Token header is accepted on all KMS endpoints when vault_api_enabled is set to true, allowing transit and PKI clients to operate without a separate native KMS credential.
Vault Transit engine routes are available for creating, listing, and deleting keys, as well as signing with configurable signature algorithms including PSS and PKCS1v15. The Vault PKI engine route supports POST /root/sign-intermediate with TTL forwarding.
New CLI subcommands are available under ckms vault approle for AppRole administration, including creating, listing, and deleting roles, and generating or destroying secret IDs.
A transparent authentication reverse proxy forwards all requests under /v1/auth/ to the auth-verifier, stripping the /v1 prefix.
KUBERNETES AND HELM SUPPORT
A Kubernetes KMS Provider Plugin implementing the KMS v2 gRPC API is now available for encrypting Kubernetes secrets at rest in etcd. A Kubernetes Secrets Store CSI Driver Provider enables mounting KMS-managed secrets as files.
A Kubernetes operator has been added with a controller, admission webhook, and init-container inject mode. A Helm chart is provided for Kubernetes deployment with configurable values, RBAC, HPA, PDB, and NetworkPolicy support.
KMIP ENHANCEMENTS
Support for the AlwaysSensitive KMIP attribute (KMIP 2.1 section 4.3) has been added. This attribute is set to True at creation if the Sensitive attribute is set, and permanently False once Sensitive has ever been set to False.
KMIP 1.x attribute version gating is now enforced. The server no longer returns attributes that the client protocol version does not define, preventing parse failures in KMIP 1.0 through 1.3 clients such as Synology DSM, PyKMIP, and Percona.
The Never Extractable attribute is now correctly serialized in KMIP 1.x responses.
AUTHENTICATION VERIFIER INTEGRATION
Authentication methods are now delegated to the external Cosmian Authentication Verifier service. Supported methods include login and password with TOTP two-factor authentication for the Web UI and ckms login CLI, as well as X-Vault-Token for Vault AppRole, Vault Kubernetes, and Vault Token authentication.
BUG FIXES - KMIP CONFORMANCE
Lease Time was encoded as TTLV Integer instead of Interval, causing strictly typed clients to reject every GetAttributes response carrying it. This has been fixed.
RNG Parameters.Cryptographic Length was encoded as LongInteger instead of Integer, making the Random Number Generator attribute undecodable. This has been corrected.
DeleteAttribute responses previously omitted the deleted Attribute, which is required by KMIP 1.4 section 4.16. This is now included.
DeleteAttribute by name was a silent no-op for most attributes, previously handling only 9 tags. Full coverage is now implemented.
The Comment attribute was write-only and never returned by GetAttributes. This has been fixed.
BUG FIXES - SERVER AND INFRASTRUCTURE
Fixed OpenSSH authentication failures. The PKCS#11 C_SignInit now uses class-aware CKA_ID lookup.
Fixed stale connections in the ckms CLI. HTTP requests now retry once on stale pooled connections.
Removed busybox from the Docker image.
Fixed the mdBook documentation build.
Updated AWS XKS service.
Enabled strict configuration parsing to reject unknown fields.
Fixed Nix upgrade for Rust toolchain.
TESTING
SPIRE PKI capability validation covers 10 scenarios (M-01 through M-10) based on the Aembit RFI test plan, including self-signed certificate rejection, TLS version enforcement, algorithm policy propagation, client and server certificate parity, latency hard gate, and timed revocation propagation.
Go-based KMIP compliance tests using ovh/kmip-go cover KMIP versions 1.0 through 1.4 with 16 tests validating DiscoverVersions, Query, AES/RSA/EC key lifecycle, Locate, batch operations, encrypt/decrypt, sign/verify, and version-gating of KMIP 1.4 and later attributes.
DOCUMENTATION
A major mdBook documentation overhaul has been completed. TLS configuration wizard documentation and PostgreSQL failover retry and standby cluster documentation have been added.
VERSION 5.25.0 - July 9, 2026
KEY ROTATION
Full KMIP key rotation support has been implemented, including ReKey for symmetric keys, ReKeyKeyPair for RSA, EC, ML-KEM, ML-DSA, SLH-DSA, X25519, and secp256k1 key types, and ReCertify for certificate rotation as defined in KMIP section 4.8.
Keyset resolution is supported with name@latest, name@first, and name@N syntax. Try-each-key decryption walks the chain from newest to oldest for Decrypt, SignatureVerify, and MACVerify operations.
KMIP 2.1 section 3.31 state-based key selection is implemented. Deactivated and Compromised keys are accepted for processing operations. Section 4.57 auto-deactivation is triggered when the DeactivationDate is reached.
HSM keyset support is available. Metadata is stored in CKA_LABEL using the format name::gen::base_id with an optional ::latest suffix. Re-Key on HSM UIDs generates a new HSM key.
The --keyset-warn-depth flag (default: 5) returns the X-KMS-Keyset-Depth response header. Key chain traversal is unbounded with cycle detection only.
New CLI subcommands include ckms sym/ec/rsa/pqc keys re-key, set-rotation-policy, and get-rotation-policy. The --rotation-name, --rotation-interval, and --rotation-offset flags are available on all keys create commands.
The Web UI includes a Rotation Policy top-level sidebar section with Set, Get, and Re-Key pages for all four key types. The PQC entry is hidden in FIPS mode.
AUTO-ROTATION SCHEDULER
An automatic rotation scheduler has been implemented. It queries keys due for rotation, routes to ReKey or ReKeyKeyPair as appropriate, and skips HSM-resident keys identified by the hsm:: prefix.
Renewal warning dispatch emits info-level logs at 30, 7, and 1-day thresholds before the next rotation deadline.
An OpenTelemetry counter named kms.key.auto_rotation tracks rotation events with uid, algorithm, and outcome labels.
JWKS ENDPOINT
A new GET /.well-known/jwks.json endpoint provides unauthenticated public-key discovery per RFC 7517. The endpoint serves RSA, EC P-256/P-384/P-521, and Ed25519 keys in non-FIPS mode. ETag and HTTP 304 caching is supported. An X-JWKS-Truncated header is returned when the key list exceeds the configured maximum.
New configuration flags include --jwks-endpoint-enabled (default: false), --jwks-endpoint-max-keys (default: 50), and --jwks-endpoint-auto-tag (default: true).
PERFORMANCE IMPROVEMENTS
An in-memory object cache backed by the moka library provides lock-free sharded reads with time-to-idle eviction and configurable LRU capacity.
A dedicated CEK cache has been added for JOSE /encrypt and /decrypt endpoints.
A binary TTLV bytes serializer and deserializer (TTLVBytesSerializer and TTLVBytesDeserializer) provides zero-copy wire encoding.
The --unwrapped-cache-max-size configuration option (environment variable KMS_UNWRAPPED_CACHE_MAX_SIZE, default: 1000) replaces the previous hardcoded limit of 100.
The --http-workers option (environment variable KMS_HTTP_WORKERS) is now available. SQLite uses a 64 MiB page cache and a 256 MiB mmap window. PostgreSQL uses prepare_cached for tag-list queries.
A new ckms bench subcommand provides TTLV bytes, TTLV JSON, JOSE, and HTTP load benchmarks.
WEB UI AND SEARCH IMPROVEMENTS
The Locate table now includes Crypto Algorithm and Crypto Length columns with sort controls on all columns. Date defaults to descending order. Horizontal scrolling is enabled. Pagination defaults to 50 entries per page with options of 50, 100, 500, and 1000.
The certificate map display now filters out empty, null, and undefined entries to show only populated fields.
BUG FIXES - DATABASE
Added indexes on objects.owner, objects.state, read_access.userid, and objects.wrapping_key_id for PostgreSQL and MySQL. These indexes were previously only present in SQLite.
PostgreSQL now uses RecyclingMethod::Verified to eliminate dead-connection races after primary failover. Warning-level logs are emitted at every retry point.
BUG FIXES - KMIP AND KEY ROTATION
Fixed RSA/EC ReKeyKeyPair in FIPS mode by propagating CryptographicUsageMask from the old key pair into the new CreateKeyPair request.
Fixed HSM self-wrap by skipping the hsm:: UID prefix during server-wide KEK wrapping to prevent infinite recursion.
Fixed date-based Active/PreActive transitions and activation_date storage for PreActive keys in the object lifecycle setup.
BUG FIXES - WEB UI
Fixed the Date column: dates are now returned as milliseconds and the Locate sorter normalizes all timestamps to the same unit.
Fixed the Certificate Issuance page Option 3 to call ReCertify, which creates a new UID with replacement links, instead of Certify which performs an in-place upsert.
BUG FIXES - WASM
Fixed a build failure caused by tracing-appender 0.2.5 and the symlink crate being incompatible with the wasm32-unknown-unknown target. Resolved by upgrading to cosmian_logger 0.7.2.
DOCUMENTATION
Key auto-rotation documentation covers 6 rotation scenarios, policy attributes, the server-side scheduler, and implementation roadmap.
JWKS endpoint documentation includes a quickstart guide, sequence diagram, key selection, and rotation guide.
Object and Unwrapped Caches reference documentation is available in the configuration section.
Per-component log call-site documentation includes an interactive level-filter UI.
Additional details
Usage instructions
WARNING : The region east-us1 must not be used to deploy Cosmian products ! It is only present due to an AWS testing constraint but this region does not allow the deployment of confidential VM for the moment.
Make sure to enable the configuration related to AMD SEV-SNP option located in the advanced details tab within the marketplace deployment page.
As the Cosmian KMS is deployed on top of a Cosmian Verifiable VM, cosmian_vm_agent starts for the first time, it initializes several components:
- It generates a self-signed certificate and sets the CommonName of the certificate to the value of the machine hostname.
- It generates a LUKS container (/var/lib/cosmian_vm/container) and mounts it at /var/lib/cosmian_vm/data. Note that /var/lib/cosmian_vm/tmp is a tmpfs. It is encrypted but it should contain only volatile data since it is erased at each VM reboot. Data in this directory is encrypted due to the fact that the RAM is encrypted.
- It generates the TPM endorsement keys.
It is recommended to configure 1. and 2. on your own for production systems.
The certificate can be changed at will:
- Edit your DNS register to point to that VM.
- Create a trusted certificate using the method of your choice (e.g., Let's Encrypt) or use cosmian_certtool.
- Edit the cosmian_vm_agent configuration file to point to the location of the TLS certificate and private key.
The LUKS container can be regenerated using cosmian_fstool with your own size and password (to store by yourself in a secure location). It is recommended to use an additional backup disk to store the container. You can skip all these first startup steps by setting COSMIAN_VM_PREINIT=0 when starting cosmian_vm_agent.
Once the image is instantiated (on GCP, Azure, or AWS), the <code>cosmian_vm_agent</code> automatically starts as a systemd service when the VM boots.
You can now install any packages or applications you want on the VM.
Your VM is now set and ready.
Finally, please follow the deployment process to configure your KMS properly: https://docs.cosmian.com/deployment/cosmian_vm_kms/
Resources
Vendor resources
Support
Vendor support
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
This Cosmian Verifiable VM has charges associated with the use of the software from UAT to Production and also standard support from Cosmian.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.