Right now we're using our own built-in solution based on SSS, and we want to switch to KMS.
How far can we go? Can we use AWS' KMS for both the KEK and the DEK?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
There's nothing within the PCI DSS which would prevent you from using AWS KMS for both the KEK and the DEK.
You should ensure you're generating strong keys, the KEK is equivalent strength to the DEK (e.g. both AES 256-bit), the DEK is encrypted by the KEK and you have separate key custodians for key components.