Microsoft Azure → Amazon Web Services
AWS equivalent of Azure Key Vault Managed HSM
The closest AWS equivalent of Azure Key Vault Managed HSM is AWS Key Management Service (KMS).
About Azure Key Vault Managed HSM
| Provider | Microsoft Azure |
|---|---|
| Status | Generally available |
| What it is | Fully managed, single-tenant HSM pools (FIPS 140-3 Level 3) for keys only, with local RBAC and customer-controlled security domain. |
| Documentation | learn.microsoft.com |
| Pricing | Official pricing page |
AWS mappings (1)
| Capability | AWS equivalent | Match |
|---|---|---|
| Managed encryption keys | AWS Key Management Service (KMS) | Direct match |
Keys, secrets & certificates(1)
Managed encryption keys Direct match
AWS KMS maps to Azure Key Vault (keys), or Key Vault Managed HSM for single-tenant, HSM-only key storage.
- Integration. KMS keys are used directly by most AWS services for encryption at rest. On Azure, platform-managed keys are the default, and customer-managed keys in Key Vault or Managed HSM are an opt-in per service.
- Scope. KMS is one regional service per account. Key Vault is a resource you create (often one per app per environment) that holds keys, secrets, and certificates together.
- HSM protection. All KMS keys are protected by FIPS-validated HSMs. Key Vault Standard uses software-protected keys, and Premium or Managed HSM uses FIPS 140-3 Level 3 HSMs.