How Azure Key Vault and AWS KMS differ on scope, key custody, deployment and cost.
| Azure Key Vault | AWS KMS | |
|---|---|---|
| Type | Cloud KMS | Cloud KMS |
| Scope | Keys, secrets, certificates | Encryption keys |
| Deployment | SaaS (Azure) | SaaS (AWS) |
| Key custody | Premium tier: FIPS 140-2 Level 2/3 HSMs; Managed HSM available | FIPS 140-3 Level 3 validated HSMs |
| How it works | One service holding three different things: cryptographic keys, arbitrary secrets and TLS certificates. Standard is software-protected, Premium is HSM-backed, and Managed HSM gives a single-tenant pool. Certificate lifecycle is included, which the other clouds keep separate. | Keys never leave the service — you call it to encrypt and decrypt rather than fetching key material. Envelope encryption is the normal pattern: KMS protects a data key, the data key protects your data. Every AWS service integrates natively, which is most of the value. |
| Pricing* | Metered per operation; Premium adds HSM | $1/key/mo + $0.03 per 10k requests |
| Free tier | No | Yes |
| Licence | — | — |
| Best for | Microsoft-centric estates | Anything already running on AWS |
Choose Azure Key Vault for microsoft-centric estates. Choose AWS KMS for anything already running on aws.
* Published list pricing (vendor pricing pages, August 2026).