Keys, secrets & certificates
AWS Key Management Service (KMS) vs Azure Key Vault / Azure Key Vault Managed HSM
AWS KMS maps to Azure Key Vault (keys), or Key Vault Managed HSM for single-tenant, HSM-only key storage.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | AWS Key Management Service (KMS) | Azure Key Vault Azure Key Vault Managed HSM |
| Lifecycle | Generally available | Generally available Generally available |
| What it is | Managed encryption keys (symmetric, asymmetric, and HMAC) protected by FIPS-validated HSMs and integrated with most AWS services, with key policies, grants, and automatic rotation. | Stores keys, secrets, and certificates. Standard uses software-protected keys, and Premium adds HSM-protected keys (FIPS 140-3 Level 3 HSMs), with RBAC, soft delete, and purge protection. Fully managed, single-tenant HSM pools (FIPS 140-3 Level 3) for keys only, with local RBAC and customer-controlled security domain. |
| Pricing model | Per customer-managed key per month plus per 10,000 requests. | Per key operation (with higher rates for HSM keys and per-key monthly fees for HSM keys in Premium). Managed HSM is billed per HSM pool-hour. |
| Docs | AWS Key Management Service (KMS) docs | Azure Key Vault docs Azure Key Vault Managed HSM docs |
| Pricing page | AWS Key Management Service (KMS) pricing | Azure Key Vault pricing Azure Key Vault Managed HSM pricing |
| Exams | SAA-C03 SCS-C03 DVA-C02 Retiring | AZ-104 SC-500 |
Key differences
- Integration. KMS keys are used directly by most AWS services for encryption at rest. On Azure, platform-managed keys are the default, and customer-managed keys in Key Vault or Managed HSM are an opt-in per service.
- Scope. KMS is one regional service per account. Key Vault is a resource you create (often one per app per environment) that holds keys, secrets, and certificates together.
- HSM protection. All KMS keys are protected by FIPS-validated HSMs. Key Vault Standard uses software-protected keys, and Premium or Managed HSM uses FIPS 140-3 Level 3 HSMs.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Per customer-managed key per month plus per 10,000 requests. AWS Key Management Service (KMS) pricing →
- Azure
- Per key operation (with higher rates for HSM keys and per-key monthly fees for HSM keys in Premium). Managed HSM is billed per HSM pool-hour. Azure Key Vault pricing → Azure Key Vault Managed HSM pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Solutions Architect – Associate SAA-C03 | AWS | Associate | current Italian version retires after Dec 31, 2026. |
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| AWS Certified Developer – Associate DVA-C02 | AWS | Associate | retiring Being updated to DVA-C03. Registration for DVA-C03 opens Oct 27, 2026. Last day to take DVA-C02 is Nov 30, 2026. |
| Microsoft Certified – Azure Administrator Associate AZ-104 | Azure | Associate | current |
| Microsoft Certified – Cloud and AI Security Engineer Associate SC-500 | Azure | Associate | current New certification. A practice assessment isn't available yet, which the page says usually means the exam recently left (or is in) beta. |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of AWS Key Management Service (KMS)?
AWS KMS maps to Azure Key Vault (keys), or Key Vault Managed HSM for single-tenant, HSM-only key storage.
How does pricing compare between AWS Key Management Service (KMS) and Azure Key Vault and Azure Key Vault Managed HSM?
AWS: Per customer-managed key per month plus per 10,000 requests. Azure: Per key operation (with higher rates for HSM keys and per-key monthly fees for HSM keys in Premium). Managed HSM is billed per HSM pool-hour. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Solutions Architect – Associate (SAA-C03); AWS Certified Security – Specialty (SCS-C03); AWS Certified Developer – Associate (DVA-C02) [retiring]; Microsoft Certified – Azure Administrator Associate (AZ-104); Microsoft Certified – Cloud and AI Security Engineer Associate (SC-500).