Nitro Enclaves and Key Management Service (KMS) can be integrated to offload key management tasks from applications to the AWS-managed service. The KMS provides a unified public API for creating and managing keys backed by Hardware Security Modules (HSMs) to the broader AWS ecosystem. There are three main key types supported by KMS: Customer-managed keys (CMK), Data keys (DK), and Data key pairs. The integration of KMS with Nitro Enclaves comes with new threats, including passive and active attacks against the enclave-KMS communication channel. To prevent passive attacks, it is essential to use encryption context, authorize requests to KMS properly, and use the correct CMK. The encryption context is decided by enclaves and is not fully attacker-controlled, which helps to prevent attacks such as data swap attacks. Additionally, using the Recipient parameter, which includes attestation, allows KMS to validate PCRs and prevent unauthorized access. The use of key commitment property is also crucial to prevent attacks that involve generating a single ciphertext that correctly decrypts under different keys. Overall, the integration of KMS with Nitro Enclaves requires careful consideration of security risks and the implementation of measures to prevent passive and active attacks. By following best practices, such as using encryption context and authorizing requests to KMS properly, developers can help ensure the secure integration of KMS with Nitro Enclaves. The security of the enclave-KMS communication channel is critical to preventing attacks and ensuring the confidentiality and integrity of sensitive data.