Keys, secrets & certificates · AWS vs Google Cloud
AWS Key Management Service (KMS) vs Cloud Key Management Service / Cloud HSM / Cloud External Key Manager
AWS KMS maps to Cloud KMS, with software, hardware (Cloud HSM), and external (Cloud EKM) protection levels.
Side-by-side comparison
| Aspect | Amazon Web Services | Google Cloud |
|---|---|---|
| Service | AWS Key Management Service (KMS) | Cloud Key Management Service Cloud HSM Cloud External Key Manager |
| Lifecycle | Generally available | Generally available Generally available Generally available |
| What it is | Managed encryption keys (symmetric, asymmetric, and HMAC) protected by FIPS-validated HSMs and integrated with most AWS services, with key policies, grants, and automatic rotation. | Software, hardware (Cloud HSM), and external keys with key-version and operation pricing. Keys protected in clusters of FIPS 140-2 Level 3 certified HSMs, managed through Cloud KMS. Use keys held in a supported external key manager outside Google Cloud. |
| Pricing model | Per customer-managed key per month plus per 10,000 requests. | Billed per active key version per hour by protection level, plus key operations. |
| Docs | AWS Key Management Service (KMS) docs | Cloud Key Management Service docs Cloud HSM docs Cloud External Key Manager docs |
| Pricing page | AWS Key Management Service (KMS) pricing | Cloud Key Management Service pricing Cloud HSM pricing Cloud External Key Manager pricing |
Key differences
- Customer-managed encryption keys (CMEK) integrate with many Google Cloud services.
- Cloud EKM keeps key material in a supported external key manager.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Per customer-managed key per month plus per 10,000 requests. AWS Key Management Service (KMS) pricing →
- GCP
- Billed per active key version per hour by protection level, plus key operations. Cloud Key Management Service pricing → Cloud HSM pricing → Cloud External Key Manager pricing →
And on Azure?
Direct match Azure's equivalent is Azure Key Vault, Azure Key Vault Managed HSM. AWS vs Azure comparison →
FAQ
What is the Google Cloud equivalent of AWS Key Management Service (KMS)?
AWS KMS maps to Cloud KMS, with software, hardware (Cloud HSM), and external (Cloud EKM) protection levels.
How does pricing compare between AWS Key Management Service (KMS) and Cloud Key Management Service, Cloud HSM and Cloud External Key Manager?
AWS: Per customer-managed key per month plus per 10,000 requests. Google Cloud: Billed per active key version per hour by protection level, plus key operations. Check the official pricing pages for current rates.
What is the Azure equivalent?
Azure Key Vault and Azure Key Vault Managed HSM (direct match). AWS KMS maps to Azure Key Vault (keys), or Key Vault Managed HSM for single-tenant, HSM-only key storage.