Customer-managed keys (CMK) are encryption keys that the customer creates, stores, rotates, and controls, rather than leaving that control to the cloud provider. The service may still encrypt data, but the provider cannot fully use or disclose the protected content without the customer’s permission or key access.
CMK matters because control of the key is often control of the data. In cyber security, it reduces the risk that a provider, administrator, or third party can access plaintext data through internal misuse, legal compulsion, or a provider-side compromise. It is also a common defense for regulated workloads, where organizations need stronger auditability, separation of duties, and the ability to revoke access quickly. In real environments, CMK is only effective if the keys are truly isolated, backed by a recoverable key management process, and tested for failover and service exit. A broken key strategy can turn encryption into a lockout instead of a protection.