Microsoft Azure → Amazon Web Services
AWS equivalent of Azure Key Vault
The closest AWS equivalents of Azure Key Vault are AWS Key Management Service (KMS) and AWS Secrets Manager.
About Azure Key Vault
| Provider | Microsoft Azure |
|---|---|
| Status | Generally available |
| What it is | Stores keys, secrets, and certificates. Standard uses software-protected keys, and Premium adds HSM-protected keys (FIPS 140-3 Level 3 HSMs), with RBAC, soft delete, and purge protection. |
| Documentation | learn.microsoft.com |
| Pricing | Official pricing page |
AWS mappings (2)
| Capability | AWS equivalent | Match |
|---|---|---|
| Managed encryption keys | AWS Key Management Service (KMS) | Direct match |
| Secrets storage and rotation | AWS Secrets Manager | Direct match |
Keys, secrets & certificates(2)
Managed encryption keys Direct match
AWS KMS maps to Azure Key Vault (keys), or Key Vault Managed HSM for single-tenant, HSM-only key storage.
- Integration. KMS keys are used directly by most AWS services for encryption at rest. On Azure, platform-managed keys are the default, and customer-managed keys in Key Vault or Managed HSM are an opt-in per service.
- Scope. KMS is one regional service per account. Key Vault is a resource you create (often one per app per environment) that holds keys, secrets, and certificates together.
- HSM protection. All KMS keys are protected by FIPS-validated HSMs. Key Vault Standard uses software-protected keys, and Premium or Managed HSM uses FIPS 140-3 Level 3 HSMs.
Secrets storage and rotation Direct match
AWS Secrets Manager maps to Azure Key Vault secrets.
- Rotation. Secrets Manager has built-in rotation (managed for RDS and other services, or Lambda-based). Key Vault raises near-expiry events through Event Grid, and you rotate with Azure Functions or automation. Better still, use managed identities so there's no secret to rotate.
- Cheaper alternative on AWS. Systems Manager Parameter Store also holds secrets (SecureString) without built-in rotation.