The difference between the cloud promising not to look and the cloud being unable to.
Bring your own key means you generate the key material and import it. Provenance improves — you know how it was created — but the provider now holds it and can use it. The protection is contractual and procedural.
Hold your own key means the key never enters the provider. Every operation is a call back to your key manager, which can refuse. This is the only arrangement where denying access is a technical fact rather than a policy commitment, and it costs you latency and a hard availability dependency: if your key service is down, the data is unreadable. That is not a bug, it is the feature you asked for.
External Key Manager is the most straightforward route to real HYOK on a hyperscaler.
One key plane across clouds with the material held in enclaves you control.
The route auditors in regulated industries tend to already accept.
External key stores exist here too — check the latency budget before committing.
Decide honestly whether you need HYOK or merely want it. It is a serious availability trade, and teams that adopt it for reassurance rather than requirement usually regret it during the first outage.
Tell us which clouds you run in, whether the requirement is keys or secrets or both, and whether a regulator is involved. You get a shortlist and the reasoning behind it. Your details are not passed to vendors.