I am trying to understand how AWS KMS works, and there is one thing I am still not completely sure of: when using CMKs, so no Data Keys, no envelop encryption, does the encryption take place in the cloud? Maybe because it's so obvious that it happens in the cloud, but I haven't been able to find a clear answer anywhere in the documentation or in related sites. They keep saying that KMS manages the keys for you, but not that it always perform encryption/decryption when using CMKs, as I would expect. For instance here:
AWS Key Management Service (AWS KMS) is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data. The customer master keys that you create in AWS KMS are protected by hardware security modules (HSMs).
A key management system (KMS), also known as a cryptographic key management system (CKMS), is an integrated approach for generating, distributing and managing cryptographic keys for devices and applications. They may cover all aspects of security - from the secure generation of keys over the secure exchange of keys up to secure key handling and storage on the client. Thus, a KMS includes the backend functionality for key generation, distribution, and replacement as well as the client functionality for injecting keys, storing and managing keys on devices.
Only in this other site is mentioned that
They [CMKs] never leave AWS KMS FIPS validated hardware security modules.
Can someone confirm that encryption/decryption happens in the cloud, not locally? If so, is that (one of the main reasons) why symmetric keys are used in KMS?