AWS KMS, GCP Cloud KMS & Azure Key Vault
Compare cloud KMS offerings and implement envelope encryption.
AWS KMS, GCP Cloud KMS & Azure Key Vault is a free Cryptology Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Cloud KMS?
Cloud KMS services provide HSM-backed key management as a fully managed service. You never see the raw key material; the cloud provider's HSM fleet stores and uses it on your behalf.
AWS Key Management Service
AWS KMS offers: Customer Managed Keys (CMK), AWS Managed Keys (per-service), and Customer-Provided Keys (BYOK). Keys are replicated across AZs. Integration with 100+ AWS services via IAM policies.
AWS KMS: Envelope Encryption in Practice
S3 uses SSE-KMS: S3 requests a data key from KMS, encrypts the object, discards the plaintext DEK. On download S3 calls KMS to decrypt the stored encrypted DEK. Your CMK never leaves KMS.
import boto3
kms = boto3.client("kms", region_name="us-east-1")
# Generate a data key — plaintext for immediate use, ciphertext to store
response = kms.generate_data_key(
KeyId="alias/my-app-key",
KeySpec="AES_256"
)
plaintext_dek = response["Plaintext"] # use then immediately zero
encrypted_dek = response["CiphertextBlob"] # store alongside ciphertext
print("DEK generated, encrypted DEK size:", len(encrypted_dek))GCP Cloud KMS
GCP KMS supports symmetric AES-256 and asymmetric RSA/ECDSA keys. Key rings group keys by region and project. Cloud HSM option provides FIPS 140-2 Level 3 hardware backing. IAM controls via roles/cloudkms.*.
GCP KMS: Signing with a Cloud Key
Applications can sign data with an HSM-backed private key without ever holding the key material. Used by GCP Certificate Authority Service and Artifact Registry for software attestation.
Azure Key Vault
Azure Key Vault stores keys, secrets (passwords, connection strings), and certificates. Premium tier uses FIPS 140-2 Level 2 HSMs; Managed HSM uses Level 3. RBAC via Azure AD with fine-grained key-operation policies.
Bring Your Own Key (BYOK)
All three cloud KMS services support BYOK: generate the key on your on-premises HSM, wrap it with the cloud KMS key-wrapping public key, import the wrapped key material. You control the origin.
Key Rotation Policies
AWS KMS: automatic rotation every year for symmetric CMKs (keeps old versions for decryption). GCP KMS: configurable rotation period per key ring. Azure: rotation policy with expiry notifications via Event Grid.
Audit Logging
All KMS calls (GenerateDataKey, Decrypt, Sign) are logged: AWS CloudTrail, GCP Cloud Audit Logs, Azure Monitor. Every key usage is auditable — critical for compliance (PCI-DSS, HIPAA, SOC2).
Pricing and Latency Considerations
Cloud KMS adds ~1-5ms latency per call. Cost: AWS ~$1/key/month + $0.03/10k API calls; GCP similar; Azure per-operation. Use data keys (cache plaintext DEK in memory) to minimise KMS calls per request.
Knowledge Check
When using AWS SSE-KMS for S3, which entity holds the plaintext data encryption key during object storage?
Lesson Recap
AWS KMS, GCP Cloud KMS, and Azure Key Vault provide managed HSM-backed key management. Envelope encryption keeps data keys ephemeral. BYOK allows key origin control. Audit logs record every key operation for compliance. Cache DEKs in memory to control KMS call frequency.
Frequently asked questions
Is the “AWS KMS, GCP Cloud KMS & Azure Key Vault” lesson free?
Yes — the full text of “AWS KMS, GCP Cloud KMS & Azure Key Vault” is free to read here on the web, and the Cryptology Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO.
What will I learn in “AWS KMS, GCP Cloud KMS & Azure Key Vault”?
Compare cloud KMS offerings and implement envelope encryption. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cryptology Academy?
No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “AWS KMS, GCP Cloud KMS & Azure Key Vault” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cryptology Academy lesson?
Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Key Lifecycle: Generate, Store, Rotate, Destroy
- HSM Architecture & PKCS#11 Interface
- AWS KMS, GCP Cloud KMS & Azure Key Vault
- Key Escrow, Backup & Recovery Procedures