Because AWS cannot control the end-to-end availability of the connection between AWS KMS and your external key store infrastructure, we specifically exclude the use of XKS in our public KMS availability SLA. Also, XKS keys are excluded in the availability SLA for any AWS service in which an XKS key is configured by you to encrypt data within the service.