AWS KMS protects the customer master keys (CMKs) that you use to protect your data and data keys.

Your secret keys are generated and used only in hardware security modules designed

so that no one, including AWS employees, can access the plaintext key material.