KMS
acronymcloudsecuritycryptography
Key Management Service: the managed vault where encryption keys live, guarded by hardware, used via API, and never exported in the clear.
You call it to encrypt and decrypt; the master key itself never leaves the service.