Amazon Web Services → Microsoft Azure
Azure equivalent of AWS Key Management Service (KMS)
AWS KMS maps to Azure Key Vault (keys), or Key Vault Managed HSM for single-tenant, HSM-only key storage.
About AWS Key Management Service (KMS)
| Provider | Amazon Web Services |
|---|---|
| Status | Generally available |
| What it is | Managed encryption keys (symmetric, asymmetric, and HMAC) protected by FIPS-validated HSMs and integrated with most AWS services, with key policies, grants, and automatic rotation. |
| Documentation | docs.aws.amazon.com |
| Pricing | Official pricing page |
Azure mappings (1)
| Capability | Azure equivalent | Match |
|---|---|---|
| Managed encryption keys | Azure Key Vault, Azure Key Vault Managed HSM | Direct match |
Keys, secrets & certificates(1)
Managed encryption keys Direct match
AWS KMS maps to Azure Key Vault (keys), or Key Vault Managed HSM for single-tenant, HSM-only key storage.
- Integration. KMS keys are used directly by most AWS services for encryption at rest. On Azure, platform-managed keys are the default, and customer-managed keys in Key Vault or Managed HSM are an opt-in per service.
- Scope. KMS is one regional service per account. Key Vault is a resource you create (often one per app per environment) that holds keys, secrets, and certificates together.
- HSM protection. All KMS keys are protected by FIPS-validated HSMs. Key Vault Standard uses software-protected keys, and Premium or Managed HSM uses FIPS 140-3 Level 3 HSMs.