Encrypting data is easy, but keeping the encryption key safe is the hard part. A cloud KMS holds master keys that never leave the service, controls their use with IAM and logs every use. Reach for it to encrypt disks, backups or files, usually through envelope encryption. To store a value like a database password, use a secret manager instead, which uses KMS under the hood.