← All comparisons

OpenBao vs AWS KMS

How OpenBao and AWS KMS differ on scope, key custody, deployment and cost.

	OpenBao	AWS KMS
Type	OSS secrets platform	Cloud KMS
Scope	Secrets, keys, PKI	Encryption keys
Deployment	Self-hosted	SaaS (AWS)
Key custody	PKCS#11 auto-unseal in community builds	FIPS 140-3 Level 3 validated HSMs
How it works	Forked from the last MPL-licensed Vault release and developed under Linux Foundation governance. The API and concepts are the ones your team already knows, which makes migration realistic rather than theoretical — the point of the project is that no single company can change the terms again.	Keys never leave the service — you call it to encrypt and decrypt rather than fetching key material. Envelope encryption is the normal pattern: KMS protects a data key, the data key protects your data. Every AWS service integrates natively, which is most of the value.
Pricing*	Free	$1/key/mo + $0.03 per 10k requests
Free tier	Yes	Yes
Licence	MPL-2.0	—
Best for	Vault semantics without licence risk	Anything already running on AWS

OpenBao

Actually open source, under neutral governance
Migration path from Vault is short
No licence clause that can be changed under you

Smaller ecosystem and fewer integrations
No vendor to buy support from

AWS KMS

Integrated with essentially every AWS service
Key material never leaves the HSM boundary
Trivially cheap at small and moderate scale

Manages keys, not application secrets
Costs climb with request volume, not key count

Bottom line

Choose OpenBao for vault semantics without licence risk. Choose AWS KMS for anything already running on aws.

* Published list pricing (vendor pricing pages, August 2026).