> Specific to AWS it would be even better of the service allowed for the customer to host the CMK in their own account so they can choose to import key material

> Specific to AWS it would be even better of the service allowed for the customer to host the CMK in their own account so they can choose to import key material if they like. Looks like it does, based on https://aws.amazon.com/blogs/apn/control-access-to-your-data-with-slack-enterprise-key-management-and-aws-kms/ https://aws.amazon.com/blogs/apn/control-access-to-your-data... "With Slack EKM, you can use KMS in your own AWS account to create a Customer Master Key (CMK) that always stays under your control. Then, using key policies, you grant Slack access to use your CMK to generate and decrypt data keys."