kms.network

← All comparisons

Google Cloud KMS vs AWS KMS

How Google Cloud KMS and AWS KMS differ on scope, key custody, deployment and cost.

Google Cloud KMSAWS KMS
TypeCloud KMSCloud KMS
ScopeEncryption keysEncryption keys
DeploymentSaaS (GCP)SaaS (AWS)
Key custodyHSM tier FIPS 140-2 Level 3; External Key Manager for off-cloud keysFIPS 140-3 Level 3 validated HSMs
How it worksKey rings and key versions with explicit rotation, offered in software, HSM and external tiers. External Key Manager is the differentiator: the key stays in your own system and Google calls out to it, so the cloud can be denied access by design rather than by policy.Keys never leave the service — you call it to encrypt and decrypt rather than fetching key material. Envelope encryption is the normal pattern: KMS protects a data key, the data key protects your data. Every AWS service integrates natively, which is most of the value.
Pricing*Metered per key version + operations$1/key/mo + $0.03 per 10k requests
Free tierNoYes
Licence——
Best forGCP workloads and hold-your-own-key rulesAnything already running on AWS

Google Cloud KMS

  • Clear key ring and version model
  • External Key Manager is a genuine sovereignty answer
  • Consistent API across software and HSM tiers
  • No free tier
  • External keys add latency and a hard dependency

AWS KMS

  • Integrated with essentially every AWS service
  • Key material never leaves the HSM boundary
  • Trivially cheap at small and moderate scale
  • Manages keys, not application secrets
  • Costs climb with request volume, not key count

Bottom line

Choose Google Cloud KMS for gcp workloads and hold-your-own-key rules. Choose AWS KMS for anything already running on aws.

* Published list pricing (vendor pricing pages, August 2026).