Keys, secrets & certificates
AWS Certificate Manager (ACM) vs Key Vault certificates
AWS Certificate Manager maps to Key Vault certificates, plus free managed certificates built into App Service and Front Door.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | AWS Certificate Manager (ACM) | Key Vault certificates |
| Lifecycle | Generally available | Generally available |
| What it is | Issues, deploys, and auto-renews public and private TLS certificates for integrated services such as ELB, CloudFront, and API Gateway. | Creates, imports, and auto-renews X.509 certificates, self-signed or issued through integrated public CAs (DigiCert, GlobalSign), and deploys them to App Service, Application Gateway, and Front Door. |
| Pricing model | Public certificates for integrated services are free. Private certificates are billed through Private CA. | Key Vault charges for certificate operations and renewals. CA-issued certificates are billed by the CA. App Service and Front Door managed certificates are free. |
| Docs | AWS Certificate Manager (ACM) docs | Key Vault certificates docs |
| Pricing page | AWS Certificate Manager (ACM) pricing | Key Vault certificates pricing |
| Exams | SAA-C03 SCS-C03 | AZ-104 AZ-700 |
Key differences
- Issuance. ACM issues free public certificates (Amazon-issued) for integrated services. Key Vault doesn't issue public certificates itself; it orders them from integrated CAs (DigiCert or GlobalSign, billed by the CA) or stores imported ones. App Service and Front Door can issue free managed certificates for custom domains.
- Deployment. ACM certificates attach directly to ELB, CloudFront, and API Gateway. Key Vault certificates are referenced by App Service, Application Gateway, and Front Door.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Public certificates for integrated services are free. Private certificates are billed through Private CA. AWS Certificate Manager (ACM) pricing →
- Azure
- Key Vault charges for certificate operations and renewals. CA-issued certificates are billed by the CA. App Service and Front Door managed certificates are free. Key Vault certificates pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Solutions Architect – Associate SAA-C03 | AWS | Associate | current Italian version retires after Dec 31, 2026. |
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| Microsoft Certified – Azure Administrator Associate AZ-104 | Azure | Associate | current |
| Microsoft Certified – Azure Network Engineer Associate AZ-700 | Azure | Associate | current |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of AWS Certificate Manager (ACM)?
AWS Certificate Manager maps to Key Vault certificates, plus free managed certificates built into App Service and Front Door.
How does pricing compare between AWS Certificate Manager (ACM) and Key Vault certificates?
AWS: Public certificates for integrated services are free. Private certificates are billed through Private CA. Azure: Key Vault charges for certificate operations and renewals. CA-issued certificates are billed by the CA. App Service and Front Door managed certificates are free. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Solutions Architect – Associate (SAA-C03); AWS Certified Security – Specialty (SCS-C03); Microsoft Certified – Azure Administrator Associate (AZ-104); Microsoft Certified – Azure Network Engineer Associate (AZ-700).