kms.network

← All comparisons

Fortanix DSM vs AWS KMS

How Fortanix DSM and AWS KMS differ on scope, key custody, deployment and cost.

Fortanix DSMAWS KMS
TypeConfidential computing KMSCloud KMS
ScopeKeys, secrets, tokenisationEncryption keys
DeploymentSaaS + on-premiseSaaS (AWS)
Key custodyIntel SGX enclaves; FIPS 140-2 Level 3FIPS 140-3 Level 3 validated HSMs
How it worksData Security Manager runs key operations inside confidential-computing enclaves rather than conventional HSM appliances, presenting one key management plane across multiple clouds and on-premise. Also covers tokenisation and, increasingly, post-quantum readiness.Keys never leave the service — you call it to encrypt and decrypt rather than fetching key material. Envelope encryption is the normal pattern: KMS protects a data key, the data key protects your data. Every AWS service integrates natively, which is most of the value.
Pricing*Enterprise quote$1/key/mo + $0.03 per 10k requests
Free tierNoYes
Licence——
Best forMulti-cloud estates with strict key custodyAnything already running on AWS

Fortanix DSM

  • One control plane across clouds and on-premise
  • Enclave model removes appliance sprawl
  • Strong regulated-industry track record
  • Enterprise pricing, enterprise sales cycle
  • Overspecified for single-cloud teams

AWS KMS

  • Integrated with essentially every AWS service
  • Key material never leaves the HSM boundary
  • Trivially cheap at small and moderate scale
  • Manages keys, not application secrets
  • Costs climb with request volume, not key count

Bottom line

Choose Fortanix DSM for multi-cloud estates with strict key custody. Choose AWS KMS for anything already running on aws.

* Published list pricing (vendor pricing pages, August 2026).