AWS-Managed, Customer-Managed, and AWS-Owned Keys

AWS-owned keys are used internally by AWS services and aren't visible or manageable in your account at all — some services use these for baseline encryption with zero configuration or cost to you, and zero visibility into or control over the key.

AWS-managed keys (visible in your account, named like aws/s3 or aws/ebs) are automatically created the first time a service needs one, used as the default encryption key for that service unless you specify otherwise, free to use, but offer no custom key policy (AWS controls it) and fixed automatic rotation you can't adjust.

Customer-managed keys are keys you explicitly create and fully control: a custom key policy defining exactly who can administer and use it, optional automatic rotation (or manual control), and the ability to disable or schedule deletion. These incur a small monthly cost plus per-request charges, but are the necessary choice whenever compliance or security requirements demand access control and audit granularity beyond what an AWS-managed key's fixed defaults provide.