KMS

Data keys, key encryption keys, and where KMS calls happen in a request - the mental model behind every encrypt/decrypt call your SDK code makes.

Create a key and encrypt/decrypt a small payload via SDK - 8 starter examples covering keys, aliases, direct encryption, and rotation.

Choosing key types for encryption vs signing use cases - SYMMETRIC_DEFAULT versus RSA and ECC key specs, and when each fits.

Rotation schedules and replicating keys across regions via SDK - EnableKeyRotation and multi-region keys with CreateKey/ReplicateKey.

A checklist of KMS best practices for SDK integrations - key type choice, envelope encryption, grants over policy edits, rotation, encryption context, and auditing.