Amazon KMS Monitoring in ObserveOps
Overview
The Amazon KMS integration with ObserveOps (formerly known as AIOps) collects configuration inventory and request telemetry from AWS Key Management Service. It monitors key states, rotation settings, key material expiry, grant counts, cryptographic request volumes, throttle rates, and external key store proxy health.
These metrics help security teams track key lifecycle status, detect approaching expirations, identify throttling on cryptographic operations, and monitor the health of external key store integrations.
Prerequisites
- AWS KMS is enabled in the target AWS account and region.
- The IAM role or user used for integration has read access to KMS resources (
kms:ListKeys, kms:DescribeKey, kms:ListAliases, kms:ListGrants, cloudwatch:GetMetricData). - Required KMS and CloudWatch API endpoints are reachable from ObserveOps.
- The AWS account is added in discovery with correct credentials and region configuration.
List of Supported KPIs
Key Configuration
| Metric | Description | Type |
|---|
| aws.kms.key.state | Current state of the KMS key. | String |
| aws.kms.rotation.enabled | Indicates whether automatic key rotation is enabled. | Boolean |
| aws.kms.deletion.window.seconds | Number of seconds remaining in the key's scheduled deletion window. | Seconds |
| aws.kms.rotation.next.seconds | Seconds until the next automatic key rotation. | Seconds |
| aws.kms.aliases | Number of aliases assigned to the KMS key. | Count |
| aws.kms.grants | Number of active grants on the KMS key. | Count |
| aws.kms.key.material.expiry.seconds | Seconds until the imported key material expires. | Seconds |
Requests
| Metric | Description | Type |
|---|
| aws.kms.requests | Total number of cryptographic API requests made to the key. | Count |
| aws.kms.cloudhsm.keystore.throttles | Number of requests throttled due to CloudHSM custom key store limits. | Count |
| aws.kms.external.keystore.throttles | Number of requests throttled due to external key store limits. | Count |
| aws.kms.xks.proxy.errors | Number of errors returned by the external key store proxy. | Count |
External Key Store (XKS)
| Metric | Description | Type |
|---|
| aws.kms.xks.proxy.latency.ms | Latency of requests to the external key store proxy in milliseconds. | Milliseconds |
| aws.kms.xks.key.manager.instances | Number of active key manager instances in the external key store. | Count |
| aws.kms.xks.proxy.certificate.expiry.seconds | Seconds until the external key store proxy TLS certificate expires. | Seconds |
| aws.kms.xks.proxy.credential.age.seconds | Age of the external key store proxy authentication credentials in seconds. | Seconds |