Question: Option 1: If we [use an AWS KMS-managed customer master key (CMK)](http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html#client-side-encryption-kms-managed-master-key-intro), does that provide end-to-end encryption?

Option 2: Or, would we have to [use a client-side master key](http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html#client-side-encryption-client-side-master-key-intro), so that only the client can decrypt their data?

Answer: 
Update: KMS is not asymmetric, though you can use Envelope Encryption to generate a data key from the CMK. The key is generated on a physical HSM making it not accessible externally. You will only have to worry about the access to the CMK [which you can achieve using IAM access control](http://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html).

For a detailed explanation how the mechanism works, check the [Envelope Encryption section on the KMS Cryptographic Details white paper](https://d0.awsstatic.com/whitepapers/KMS-Cryptographic-Details.pdf).

So if you only worried about eavesdropping can be a good solution. If you are looking for strictly end-to-end encryption you might have to use asymmetric keys on which KMS can help you with too.
Aws kms does not store any data it provide you two keys

1 plain key : with the help of it you encrypt the data and delete it(key)(no need to save anywhere).

2.encrypted data key :- you need to save this key to decrypt the data( to decrypt the data first you got plain key from aws using encrypted data key) and with the help of plain key you decrypt the data.

So encryption is done at client side.