kms.network

← All comparisons

OpenBao vs Google Cloud KMS

How OpenBao and Google Cloud KMS differ on scope, key custody, deployment and cost.

OpenBaoGoogle Cloud KMS
TypeOSS secrets platformCloud KMS
ScopeSecrets, keys, PKIEncryption keys
DeploymentSelf-hostedSaaS (GCP)
Key custodyPKCS#11 auto-unseal in community buildsHSM tier FIPS 140-2 Level 3; External Key Manager for off-cloud keys
How it worksForked from the last MPL-licensed Vault release and developed under Linux Foundation governance. The API and concepts are the ones your team already knows, which makes migration realistic rather than theoretical — the point of the project is that no single company can change the terms again.Key rings and key versions with explicit rotation, offered in software, HSM and external tiers. External Key Manager is the differentiator: the key stays in your own system and Google calls out to it, so the cloud can be denied access by design rather than by policy.
Pricing*FreeMetered per key version + operations
Free tierYesNo
LicenceMPL-2.0—
Best forVault semantics without licence riskGCP workloads and hold-your-own-key rules

OpenBao

  • Actually open source, under neutral governance
  • Migration path from Vault is short
  • No licence clause that can be changed under you
  • Smaller ecosystem and fewer integrations
  • No vendor to buy support from

Google Cloud KMS

  • Clear key ring and version model
  • External Key Manager is a genuine sovereignty answer
  • Consistent API across software and HSM tiers
  • No free tier
  • External keys add latency and a hard dependency

Bottom line

Choose OpenBao for vault semantics without licence risk. Choose Google Cloud KMS for gcp workloads and hold-your-own-key rules.

* Published list pricing (vendor pricing pages, August 2026).